check 'x-forwarded-proto' for 'https' as well

This PR will add support for recognizing the originating protocol when express is running behind a reverse proxy/load balancer.  It checks the 'x-forwarded-proto' header in addition to checking if `req.secure` is true.