removed use of req.secure