only use force_ssl if in production

`https://localhost` 

:trollface: