forcing password urls to SSL, but we are not handling redirects correct,
and we aren't catching users?new due to the query param