manifest needs to be https