This also explicitly sets X-Forwarded-Proto to https which fixes the warning "Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests" which prevented the user account management page to load.