force ssl if flag set