make admin urls https-only closes #927

as per https://developers.google.com/appengine/docs/java/config/webxml#Secure_URLs
logging, TODO comments for csrf protection #1077
get csrf protection working