force (/admin|/auth) to https