try not to write locations where we force https redirect