force ssl in production to avoid problems with same origin policy