force https only on non-local