check 'x-forwarded-proto' for 'https' as well