finish signup
force SSL in production