Force SSL when not in an subdomain

This closes #30.
It also removes the `force_http` method that is not used anymore.