try SSL redirect in prod, without fanciness.