quick question: should yada/path-for return a path with the protocol as https if the current request context is http but has been forwarded from an https call?

good question @peterwestmacott - I've just had a similar issue myself today. bidi's vhosts has 6 policies but the 'local' policy chooses the first matching vhost that matches the request's vhost. If your http scheme one is ahead of the https one it picks that. This isn't optimal and bidi needs to be smarter - I will fix in due course. Let me know if you can't find a workaround and I'll escalate it