Use request.IsSecureConnection if no 'X-Forwarded-Proto' header

GetOriginalUrl was only taking into account the 'X-Forwarded-Proto' HTTP
header in determining whether the request was a secure connection. This
header is not present in non load balanced environments or in Azure
(websites and cloud services). Therefore where there is no
'X-Forwarded-Proto' HTTP header fall back to using
request.IsSecureConnection.