forcing javascript to https