When TLS is terminated on load balancer, unencrypted connection is
established to Nginx which drops "X-Forwarded-Proto" header (if set by the
load balancer) causing notorious error on (successful) authentication:
422 The change you requested was rejected