now enforcing HTTPS on Heroku