Add https middleware
Implement allow middleware

This is more generic than "only".
Bump version