force https on prod but http on dev