@lefnire => Block non-https calls to API + fix non-gzip compatible requests

1) Gzippo was blocking non-gzip compatible api requests. Since nginx is serving our static files anyway, we can just disable this on anything but development. Fixes #830

Serving static files from public with nginx:
```
location ~ ^/(images/|img/|javascript/|js/|css/|stylesheets/|flash/|media/|static/|robots.txt|humans.txt|favicon.ico) {
          root /var/www/path/to/current/public;
          access_log off;
          expires max;
}

```
It should maintain the path (`public/foo/bar.png` will be `habitrpg.com/foo/bar.png`) - make sure to update any paths

2) It's very unsafe to redirect http calls to https. I don't believe that's exactly what we were doing, but this should automatically deny any http calls to the API. nginx might pop in and try to redirect before this, but we won't know until this hits beta.habit.