add force-ssl package
remove insecure package
fixed using old setting