We should fix `ssl_required`, then. Frankly, I'm not sure it should be looking at `DEBUG` since this isn't really a debug thing, but rather an environment setup thing. I think it should have its own setting.

However, I'm game for just reworking ssl_required to allow it to be mocked. I can look into that now if you like.