Remove internal TLS, add option for HTTPS redirection

We'll let heroku or other environments supply the security