only force ssl in prod