Default `s3_protocol` used to be `http` when `:s3_permissions` are
`:public_read` (default), and `https` when `:s3_permissions` are
anything else.
With an empty String as default, if the page is served over HTTPS,
attachment URL will be HTTPS, and if the page is served over HTTP,
attachment url will be HTTP.
`public-read` is an authorization concept, independent form the
encryption of the HTTP connection used to read the file. As such, the
one shouldn't define the other.
[fixes #2038]
