Enforce https

Branched off of housekeeping, so this should come in after #47.

Don't allow HTTP requests when passwords are involved. To test accurately, we need to simulate the Heroku setup, where the router handles HTTPS and forwards HTTP requests with X-Forwarded-For and X-Forwarded-Proto headers set.

/cc @hampelm