force ssl in production
use a bootstrap form instead of form_for