bug: HTTPS isn't enforced on the sign in page