forcing SSL only for the API