implement https enforcement across all routes by default