force https on production, login input type number/password hack