HTTPS hack by default right after <HEAD>