make https mandatory