Making root application secure: always

This is so it can properly load and make API calls, which require https (and use protocol relative // in the application).
Changing auth to use Google+ sign-in.

Reviewed in https://codereview.appspot.com/10574043/