Why is Square asking for an HTTPS site even when it's under HTTPS?