optional SSL enforcement