api: add Rack::SSL in staging and production

This forces SSL for the API.