enable force_ssl in production, which also set cookie secure flag