Require SSL on login, signup, password reset
Use SSL for all logged-in requests

* Only send session cookies over SSL
* Require SSL for anything that requires login