This system must be invoked using HTTPS, not HTTP