always set forwarded protocol, to make configuration harder to break when deploying to SSL