Only use SSL, committing a cert and key we can use for now, not sure if it will work everywhere.  Add a route that lists files in a configured location when requesting '/media'.