bootstrap: use https anonymous access