Now enforces SSL (unless authenticator itself is being proxied). Other minor improvements too.