https by default because I want this to work with file:// URLs and hey, TLS should just be used everywhere, shut up