A protocol downgrade goes to http still, so MITM attacks could still happen :(