Why do clients use HTTPS for GetPackageInfo requests, but then use HTTP for GetPackageSnapshot requests?