Persist https on nav [MJ-588]

Once the conf change is in place, login/logout should not forget that a given request was https.

SECURE_PROXY_SSL_HEADER defaults to None and SESSION_COOKIE_SECURE defaults to True, so leaving them out of settings.staging.py is okay.

All tests pass.