Resolve #8 and #10: Add .htaccess to site root to enforce HTTPS. For deployment to test server add authentication to .htaccess.