change requests to only use tls