I do redirect APIs to HTTPS, but I'd prefer not to. There's a simple reason - My APIs are hosted on the same IP as the public website, behind the same load bala

I do redirect APIs to HTTPS, but I'd prefer not to. There's a simple reason - My APIs are hosted on the same IP as the public website, behind the same load balancer, so something has to be on the HTTP port. I would prefer to separate them, and my larger customers do - But for smaller customers, it's an unnecessary added expense and complication that doesn't make sense.