apparently these endpoints should be https