request should use ssl