do not require ssl for production since purchasing will be done off-site