fix misc security related bugs

* better headers
* fix bug with tickets path
* allow force_ssl via config