force ssl on sessions if configured
start a changelog
bump