ensure HTTPS is optional