force https on "gettoken" request