adds ssl_allowed to let this thing work in production