force HTTPs, remove SSLv3