updated for HTTPS