Secure is always false on heroku