Optionally force https

This forces all non-api urls to redirect to the https version of the site when the `force_https` config variable is set to `true`. The API will still be available over https but we won't redirect to it so that existing clients using the http version will continue to work correctly. When we release a new version of the API (#620) then we can start forcing https.

Fixes #326