Indeed it works in both http and https, with or without the www.
When just pasting the link (without tags) the site normally replaces protocol (http or https) and the domain (with or without www) by the one you're currently using.
For embedded links (in the url tag) indeed that replacement is not done; maybe I should add it.
I'd say it is better to use the https version, but with www or without is up to you