criteria clarification: HTTP vs HTTPS