more robust HTTPS enforcement