only redirect http->https on root requests