You might also need to turn on force_https. I without so it with sn env variable z but you can do it in the site setting