Direct HTTP browsing is restricted. Client binary updates and asset bundles require a valid HMAC-SHA256 signature header.