force https for auth while allowing http