auth relevant stuff uses @ssl_required decorator

in production the decorator redirects to https URLs.
Implements the first two points of #247.