always force https in production