secure-http flag in a composer.json doesn't work

Wrong composer.json structure. secure-http must be in the config section:

{
  ...,
  "config":{
    ...,
    "secure-http":false,
    ...
  }
  ...
}