ssl middleware, force login to be https