make sure return url after login is https