always use SSL in production