fix: force https on production
rollback: login input type number/password