fix when running under https