code: @Override
    public boolean isSecure(HttpServletRequest request) {
      String proto = request.getHeader(X_FORWARED_PROTO);
      if( proto != null ) return proto.equalsIgnoreCase(HTTPS_PROTOCOL);
      return super.isSecure(request);
    }
docs: When the X-Forwarded-Proto header is present, this method returns true if the header equals "https", false otherwise.  When
  the header is not present, it delegates this call to the super class.