use SSL everywhere in staging and production, no exceptions