Stop allowing destination serving files without tls

In legacy/trac#28647 (moved) we say that TLS is required, but sbws configuration allows destinations using plain HTTP, and it's not documented.