Remove forced redirect to https when request is not local
Remove protect_from_forgery, because its effects are unknown
Update changelog