Lock down services which accept URLs to require https where possible

[paulmelnikow]

Let's continue to nudge our ecosystem toward using https. For the most part, when we accept and refactor new services, we steer things that way, by using https endpoints and assuming https for user-provided URLs.

Let's push that forward wherever we can, perhaps by requiring https wherever we're accepting a user-provided URL.

In cases where we think there are sources which can't be migrated, we could add a flag ?allow_insecure. This would provide an extra hurdle, and would nudge them to use https if possible.

[calebcartwright]

In cases where we think there are sources which can't be migrated, we could add a flag ?allow_insecure. This would provide an extra hurdle, and would nudge them to use https if possible.

I like the sound of that!