force ssl
only enforce ssl in prod; handle scheme better