Still forcing SSL client-side ...