fix a wrong https reference that breaks auth