fix access denied w/ cas

was getting access denied on https (worked w/ http only) unless i added these two directives