force SSL in production environment
add sign in/out support