Exactly my point. They don't need to 'ban' https