Add security-constraint for /secure URIs
Fix shipping calculation bug, plus add tests