using HTTP instead of HTTPS for DDM callbacks