everything now forced through ssl since user can basically login through
any page, might want to think about directing user to something other
than home after logging in so pages can be forced to http after logging
in