remove commented-out force-ssl, since we're handling it in nginx. refer back here if needed again