assuming cloudflare terminates client TLS and reverse proxies over plain http on an encrypted channel.