allow app host to use https