serve assets over https