use https where necessary