diff --git a/jupyterhub/app.py b/jupyterhub/app.py
index c5338e87..82f86def 100644
--- a/jupyterhub/app.py
+++ b/jupyterhub/app.py
@@ -1718,6 +1718,7 @@ class JupyterHub(Application):
 
             internal_key_pair = cert_store.get("localhost")
             if not internal_key_pair:
+                import socket
                 alt_names = "IP:127.0.0.1,DNS:localhost,{extra_names}"
                 # In the event the hub needs to be accessed externally, add
                 # the fqdn and (optionally) rev_proxy to the set of alt_names.
diff --git a/jupyterhub/proxy.py b/jupyterhub/proxy.py
index 23b87ec1..aefef9fb 100644
--- a/jupyterhub/proxy.py
+++ b/jupyterhub/proxy.py
@@ -569,7 +569,6 @@ class ConfigurableHTTPProxy(Proxy):
             cmd.extend(['--api-ssl-ca', self.app.internal_ssl_ca])
             cmd.extend(['--api-ssl-request-cert'])
             cmd.extend(['--api-ssl-reject-unauthorized'])
-            cmd.extend(['--forward-ssl'])
         if self.app.statsd_host:
             cmd.extend([
                 '--statsd-host', self.app.statsd_host,
diff --git a/jupyterhub/spawner.py b/jupyterhub/spawner.py
index 19eb59c8..87a71caa 100644
--- a/jupyterhub/spawner.py
+++ b/jupyterhub/spawner.py
@@ -14,6 +14,7 @@ import shutil
 import signal
 import sys
 import warnings
+import pwd
 from subprocess import Popen
 from tempfile import mkdtemp
 
@@ -968,7 +969,6 @@ def set_user_setuid(username, chdir=True):
     home directory.
     """
     import grp
-    import pwd
     user = pwd.getpwnam(username)
     uid = user.pw_uid
     gid = user.pw_gid