use secure domain for script, but not for redirect