using https where possible