We should lead people to https URLs, but we should not assume that they *are* indeed on the https URL