Don't trigger further processing

May cause other middleware to attempt to send headers after they've
already been sent, and at this point we've already made a decision
on where to send the user.

The change to use `req.secure` is purely semantics; it's equivalent
to the previous `req.protocol` check because Express rolls in the
value of `X-Forward-Proto` according to the `trust proxy` setting.
Merge pull request #1 from timshadel/master

Avoid "Error: Can't set headers after they are sent."