restrict CURL to using HTTPS