Fixed bug with HTTPS detection

According to the PHP docs, the $_SERVER['HTTPS'] value should be empty if HTTPS it not used, but is set to the value "off" on some IIS configurations. I discovered that my web host (Webfaction) seemed to be using "off" as a value as well, for reasons unknown (they are most definitely not running IIS). This mis-detection caused all URL-dependant widgets to disappear. This change checks for either empty or the "off" value.