I suggest using https-only. http is like not wearing a mask in 2020 and scares me ;) 
