It came up at work, we checked with the author to ensure what we saw in the code and by experiment. Documenting here in case anyone else has the question.

“It forces SSL everywhere by default. The only mechanism to disable SSL is to provide a url as :endpoint that uses the http scheme instead of https.”