enforce https, bug fix