base URL is now always SSL