Turn off force_ssl in config, do it in controllers instead

This allows disabling it for JSON endpoints like /all_events.json