Both of you know it already, but it might be useful to remind the casual reader that while this is indeed not needed for tor hidden services, you still need https for regular web services accessed through tor (in some way even more than when not using tor). This interactive explanation by the EFF is worth a thousand words: https://www.eff.org/fr/pages/tor-and-https