make https: required (add redirects) and set the session cookie to https only
misc
site news banner: shutdown bill