Yeah, I'd argue that if you want that, just set `req.secure` yourself. It's not my job to determine the security of your application. You should be telling me if it's secure or not in whatever makes sense for you.