Enable force_ssl

Force all access to the app over SSL, use Strict-Transport-Security, and
use secure cookies.