probably only want the app server to force ssl, require it with the api