Use SSL only with https scheme.

When IAP_VERIFICATION_ENDPOINT is set to url not served with https, don't enforce SSL.