added slash to HOME_PATH to force secure http