HTTPS not working, no restriction on accessing user page