enforcehttps should ignore internal requests