depending on which route you take, https is not forced. will be fixed on the next release. thanks for the feedback.