added webapp.secure flag (turns on secure cookies and HSTS)
webapp - use hiera config "webapp.admins" for the list of admin usernames, default to empty list.