force all access to the app over SSL