only redirect GETs to SSL; return a 403 for the rest