force all requests to be under https