Use request.IsSecureConnection if no 'X-Forwarded-Proto' header

`GetOriginalUrl` was only taking into account the *'X-Forwarded-Proto'* HTTP header in determining whether the request was a secure connection. This header is not present in non load balanced environments or in Azure (websites and cloud services).

Therefore where there is no *'X-Forwarded-Proto'* HTTP header fallback to using `request.IsSecureConnection`