[wip] opt into https and auth