turn SSL on by default, developers can turn it off locally