use https protocol with secure flag