[WIP] we should force ssl  in the app and don’t rely on the webserver’s redirect rules.