I should clarify a bit more: we can't currently force secure, because the node server itself doesn't get https into it. It only gets http.

The server configuration enforces secure if appropriate (i.e. staging & production have it, but nothing else).