enforce HTTPS for /WebApi and all /api area