Force http redirect when not secure controller

Supports #286