change true to false for config.force_ssl in config/environments/production.rb