change forms to POST, and force redirection to secure domain.