diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,8 @@
+## 0.1.3
+
+* --require-tls command line option
+* SECURITY FIX: Don't run the app when redirecting for login
+
 ## 0.1.2
 
 * --skip-auth command line option
diff --git a/app/Rdr2tls.hs b/app/Rdr2tls.hs
new file mode 100644
--- /dev/null
+++ b/app/Rdr2tls.hs
@@ -0,0 +1,19 @@
+{-# LANGUAGE OverloadedStrings #-}
+-- | rdr2tls as a middleware
+module Rdr2tls (rdr2tls) where
+
+import Network.HTTP.Types (status307)
+import Network.Wai
+import Network.Wai.Request
+import qualified Data.ByteString as S
+
+rdr2tls :: Middleware
+rdr2tls app req send
+    | appearsSecure req = app req send
+    | otherwise =
+        let dest = S.concat
+                [ guessApproot req { isSecure = True }
+                , rawPathInfo req
+                , rawQueryString req
+                ]
+         in send $ responseLBS status307 [("Location", dest)] "Redirecting"
diff --git a/app/wai-crowd.hs b/app/wai-crowd.hs
--- a/app/wai-crowd.hs
+++ b/app/wai-crowd.hs
@@ -14,6 +14,7 @@
 import           Network.Wai.Middleware.Crowd
 import           SimpleOptions
 import           Web.ClientSession              (getKey)
+import           Rdr2tls
 
 data BasicSettings = BasicSettings
     { warpPort  :: Int
@@ -21,6 +22,7 @@
     , crowdRoot :: T.Text
     , age       :: Int
     , skipAuth  :: Bool
+    , requireTls :: Bool
     }
     deriving Show
 
@@ -52,6 +54,10 @@
         ( long "skip-auth"
        <> help "Turn off Crowd authentication, useful for testing"
         )
+    <*> switch
+        ( long "require-tls"
+       <> help "Require requests come in over a secure connection (determined via headers)"
+        )
 
 data Service = ServiceFiles FileServer
              | ServiceProxy ReverseProxy
@@ -101,4 +107,6 @@
     crowdMiddleware <- mkCrowdMiddleware cs
     app <- serviceToApp manager service
     putStrLn $ "Listening on port " ++ show warpPort
-    run warpPort $ if skipAuth then app else crowdMiddleware app
+    run warpPort
+        $ (if requireTls then rdr2tls else id)
+          (if skipAuth then app else crowdMiddleware app)
diff --git a/src/Network/Wai/Middleware/Crowd.hs b/src/Network/Wai/Middleware/Crowd.hs
--- a/src/Network/Wai/Middleware/Crowd.hs
+++ b/src/Network/Wai/Middleware/Crowd.hs
@@ -192,7 +192,6 @@
                         , cookie
                         ]
                         "Logging in"
-                    app req respond
 
 -- | Current version
 --
diff --git a/wai-middleware-crowd.cabal b/wai-middleware-crowd.cabal
--- a/wai-middleware-crowd.cabal
+++ b/wai-middleware-crowd.cabal
@@ -1,5 +1,5 @@
 name:                wai-middleware-crowd
-version:             0.1.2.1
+version:             0.1.3
 synopsis:            Middleware and utilities for using Atlassian Crowd authentication
 description:         See README
 license:             MIT
@@ -44,18 +44,22 @@
   hs-source-dirs:      app
   main-is:             wai-crowd.hs
   other-modules:       SimpleOptions
+                       Rdr2tls
   build-depends:       base
+                     , bytestring
                      , clientsession
                      , gitrev                >= 1.0
                      , http-client
                      , http-client-tls
                      , http-reverse-proxy    >= 0.4
+                     , http-types
                      , optparse-applicative  >= 0.11 && < 0.13
                      , template-haskell
                      , text
                      , transformers
                      , wai
                      , wai-app-static
+                     , wai-extra
                      , wai-middleware-crowd
                      , warp
   ghc-options:         -threaded -rtsopts -with-rtsopts=-N