Enable force_ssl in production
replace DEFAULT_URL_HOST with CANONICAL_HOST