security related changes to webapp

two things
* add config webapp.secure, default to false. if true, cookies are secure and hsts is turned on.
* add config webapp.admins, default to empty list. if configured, these accounts will get admin access in the webapp.