put extrafields behind https