I found out that I need to add a strict content security policy in the nginx.conf to enforce HTTPS:
add_header Content-Security-Policy "upgrade-insecure-requests";