force ssl by default

Why final?