It's because they don't have a HTTPS cert. I limited to just HTTPS in the interest of keeping everything easier to work with.

I might break that rule for bom though. Although I wish they would just let myself add a cert for them. I'll even do it for free if they let me!