force ssl by default

I like final. I think it's just a personal preference issue.