add support for enforcing HTTPS