check for $env->{HTTPS} = 'off'

IIS seems to set this all the time.