added guidance for HTTPS vhost