just kidding, req.secure is still broken.