request-map security https="true"

[BJ Freeman]

I made a assumption that if this is set to true it would only handle 
https request.
I am finding that http are also handled.
Is this by design?