changed web.xml to force https