switch to HTTPS, when possible