Force SSL in production

Setting the ALLOW_NON_SSL environment variable to "true" will allow SSL
Merge branch 'https_always'