https redirect is done on the server instead. also added todo