Allow HTTPS callback URLs