fixed #3 use of secure URLs when request is secure