Configurable SSL cert paths.
Redirect HTTP to HTTPS.
Add request logger.
Make ca cert config optional.
Use secure cookies that last a week.
Name session cookie "me".