some minor cleanups, enforce https