allow non-ssl endpoints