could be using an extension that force https connections.