force ssl in production

we should force ssl in the app and don’t rely on the webserver’s redirect rules.