Invalid requests

Yes, but it requires an additional frontend/backend layer to distinguish between HTTP and HTTPS. Take a look at this thread: