force HTTPS on oh_url links