use ssl for res (so works for user update)