allow http -> https redirects