Avoid "Error: Can't set headers after they are sent."

Calling `next()` may cause other middleware to attempt to send headers after they've already been sent, and at this point we've already made a decision on where to send the user.

The change to use `req.secure` is purely semantics; it's equivalent to the previous `req.protocol` check because Express rolls in the value of `X-Forward-Proto` according to the `trust proxy` setting.