Require https in production - fixes #1