*actually* https-ified header