fix unsecured url