(more) force authenticated users to use ssl