sign_out should always be https
Sign_out must be ssl in prod.

The conditional is kind of gross, but requiring self-signed certs for development seems a bit much.