lock GA normally to HTTPS, fix anonymization