fixup! Prefer TLSed URLS