forcing SSL on the production application