moved to HTTPS only (self-signed)