Don't ignore request.secure() when constructing URLs