finish user signup
force SSL in production