check for SSL; add tracing
don't allow HTTP scheme for OAuth client redirect URIs