oauth requires SSL, unless in development mode

Making a change so that we only parse the Authorization headers for
SSL requests, unless the application has the config set to development
(which is the default in config.php.dist now). This will impact on the
responsive site, which could just hit the API over SSL always.

Deploying this change needs config changes on both the api (to set 
the mode) and web2 (to use the https URL for the API) projects 
on the live server