when in doubt, use https?