Web servers must only permit use of https