secure the rest of the urls