try using ssl only for signins and resets