use nginx $host variable intead of $ssl_server_nam (which may be *.example.com) which does bogus redirects