This is obviously an issue, but I feel like this is a situation where you should ignore that part of the spec or at worst offer an http-only alternate version. When the spec is dangerously out of date like this, there's no reason to fetishize compliance.