Good to know.

I notice it isn't supporting https. Isn't that risky when connecting through Tor?

No. Traffic to .onion domains is encrypted end-to-end, with the server's public key hashing to the domain name.

Both of you know it already, but it might be useful to remind the casual reader that while this is indeed not needed for tor hidden services, you still need https for regular web services accessed through tor (in some way even more than when not using tor). This interactive explanation by the EFF is worth a thousand words: https://www.eff.org/fr/pages/tor-and-https