finally secure with force SSL set to true