enable force_ssl with production
add BUNDLE_WITHOUT to README