make sure even non-https environments can use the custom bored logic