either it's all in https or might as well be none of it