forced ssl in production for authentication