redirect to secure (if needed)