more HTTPS fixes