forcing non-ssl