use HTTPS for remote auth