Refactored login and other things along the way

- login used to be basic auth, now it's a form for just me, password,
salt, and rails secret are all stored in server as environment vars,
turned on force_ssl in production.rb
- turns out 'someth_path' can be replaced by ':something' unless you
are passing in params.
- js has to be included in head for turbolinks to work properly, b/c if
it's in body, it will be evaluated a second time when turbolinks
fetches the body