forcing https and www at the js level