default require_https to false