Check X-Forwarded-Proto in addition to request.is_secure to determine SSL.