settings: reverse_lazy rather than hard code
redirect to https for secured links