Make request.fullurl reflect the c.secure url_scheme change.
Determine c.secure status based on X-Forwarded-Proto header.

Previously, c.secure status was determined based on the domain used.
This allows for the status to vary independently of domain for greater
flexibility.

Note: it is critical that the load balancer strips any X-Forwarded-Proto
headers that may've been sent by the client.