why no https redirect?