Use secure URL for auth check