fix(login): force login links to be secure