force ssl by default