Enforcing SSL in a Web API controller