Fix https in profile URL, respecting X-Forwarded-For