fastcgu_param HTTPS based on X-Forwarded-proto header

Without this, you get an infinite HTTPS redirect for SSL content.