Allow REST API over HTTP, the rest of the site forced to HTTPS

Allow REST API over HTTP, the rest of the site forced to HTTPS