ssl_allowed for states controller