all client calls are over ssl