force SSL for everything in production (preperation for login popup)