This issue (#1867) has already been discussed 5 years ago. Now that https-api is available for a long time you should default to it. We have 2015 now and attackers use every possibility they can find.
Users should be recommended to use https if they have overridden the global.ini.php default.