Maybe it should just be enabled by default? Maybe it’s better to just be broken if they somehow try not to use https.