The endpoints are currently serviced of insecure http. HTTPs should be supported and should be the default