use secure serving url by default