allow for new option: force_https, which will force the callback url to be https, regardless of what the environment is