marked rails session cookie as secure
updated to latest version of clearance

the secure_cookie option is added there
marked remember_token cookie as secure
new cookie to redirect logged in users to https

signed_in? can't be used anymore to detect if the
user is logged in, because if you access the site
via http the auth cookie will not be available,
since it's marked as secure

session/new removed from routes because the method
itself isn't actually overridden in the
controller, only the template is
moved list of ssl-enabled envs to a single place
fix for logging in existing users

clearance changed the default password strategy
to bcrypt so it needs to be overridden here (might
be a good idea to switch to bcrypt in future using
Clearance::PasswordStrategies::BCryptMigrationFromSHA1)
Merge pull request #552 from jsuder/secure_cookie

Use secure cookies