require https on endpoints