fixed #2 use of secure URLs when request is secure