enforce SSL on production domain