fix oauth redirection to https, closes #465