allow any page to be secure. only force the ones the explicitly require it in urls.py