Don't trigger further processing

May cause other middleware to attempt to send headers after they've
already been sent, and at this point we've already made a decision
on where to send the user.

The change to use `req.secure` is purely semantics; it's equivalent
to the previous `req.protocol` check because Express rolls in the
value of `X-Forward-Proto` according to the `trust proxy` setting.