fix production url not using https