fix for oauth endpoints to https