The <urlcp secure> setting (here), added in version 6, controls whether transactions should be or must be secure, including support for OPTIONS-Upgrade secure HTTP fetches.
<urlcp secure>