Add support for forced HTTPS with HSTS grants

Right now we only give HSTS grants when the user is on g.domain
so we can easily revoke the grant. We also track changes to the
forced HTTPS pref accross sessions and modify the user's session
cookies as needed.
Redirect through HSTS granting / revoking endpoint on base domain

Since grants / revokes only happen on the base domain for simplicity,
we need to redirect through an endpoint on the base domain whenever
we perform an action that might change a user's HSTS eligibility.
Allow forcing HTTPS upon employees
Merge HTTPS prefs page with OTP page, require a password to toggle

This way we can invalidate all sessions session cookies that may
have been sent in the clear, as well as ensure that people who
can't remember their password don't get bit by the "remember me"
flag not being tracked.
Respect the https_forced property when setting cookies client-side
Set c.user when logging in

This fixes an issue with PostController.login where we didn't know
the user's HTTPS preferences at the point when they logged in
Put the 'security' tab behind a feature flag
Force HTTPS: Check the value of the 'secure_session' cookie
Use the correct abort() in modify_hsts_grant
Remove a vestigial checkbox for pref_force_https
Remove unused c.allow_loggedin_cache

This hasn't been used on reddit.com since recent changes to
how stylesheets are served, and loggedin responses cannot be
safely cached by a downstream proxy anymore.
Don't put responses with uncacheable cookies in the pagecache

This deals with people getting sent someone else's reddit_session
cookie when loggedin responses use the pagecache
Ensure downstream proxies don't cache enforce_https()'s redirect
Never try to send a user who's forcing HTTPS back to HTTP

This fixes an issue where Safari would refuse to redirect to a
`Location` with an "http:" scheme if an HSTS grant had been given
in the same response.
Don't try to pick up an HSTS grant if it's not likely to help

This also fixes some nasty business with JSONP urls where
`hsts_eligible` saw the "secure_session" cookie, but
`c.user_is_loggedin` was forced to `False`, causing a redirect loop.
Properly enforce users' cookie security preferences
Disable toolbar when using forcing HTTPS
Update security preferences page
Replace `disable_require_employee_https` with a feature flag
Add a feature flag to disable HSTS grants by default

HSTS is great, but a pain when you have HTTP-only services running
on your dev machine