production always with ssl
some more tests for the login process