Fixing Admin force SSL redirect, adding more options

Fixing SSL redirect handling behind a proxy (`sever.enable('trust
proxy')`). Also fixing handling of Admin theme resources, which should be
served via HTTP when requested.

Adding more options:

  1. Send a non-301 response - for example, 401 Unauthorized
  2. Configure a different hostname for SSL (e.g. 'https://secure.myblog.com')

Fixing #1836, #1837. Implementing #1838.