explicit https on check

in some environments it is necessary to check that $_SERVER['https'] is 'on' not just that it is set.