Require SSL for the login page.

- Require SSL for the login page (relies on X-Forwarded-Proto header).
- Mark session cookie as secure, forcing you to use SSL.
- settings.js (particularly cookie secrets) shouldn't be checked-in.

Links:

- Forcing HTTPS requests: http://stackoverflow.com/a/9724820/8446
- Secure cookies: http://stackoverflow.com/a/8462409/8446