I allowed HTTP here when making the change, because it makes testing much easier, but it really should require HTTPS.