I'm one of those grumpy devs who doesn't believe you need https if you're not handling private data. But you're probably right, sigh