Set secure based on X-FORWARDED-PROTO

If the HTTPS flag is not set, check the
X-FORWARDED-PROTO header to check if the
load balancer received a secure request