Force HTTPS on external URLs (fixes validation error)