#516 changed default to only HTTPs