We can enjoy HTTPS (encrypted, secure browsing) while the tool is on my preprod server, because I can use Letsencrypt to issue certificates.

But, so far as I know, HTTPS is not yet fully supported by IRAP, for obscure and complicated political reasons, and also diffusion of responsibility. (no-one is directly responsible for it, and please don't blame the sysadmins, they're doing a great job)

We can't have a secure backoffice if HTTPS is not enabled. There's no way around it.

Related: #24