use force https only when http: