Force SSL on all user routes