Allow only HTTP or HTTPS