Add ssl_allowed to PaypalController

Previously, when `redirect_https_to_http` was enabled, this would
redirect (or issue 426) when requested with SSL. Obviously SSL should be
allowed (if not enforced).

Fixes #105
Fixes #108