make sure app redir matches secure behavior