remove $_SERVER for native isCurrentlySecure()