change protocol to https in production OAuth