Don't redirect dynamic CSS from https to http

This can break things (d'uh).

Do this by introducing a new decorator, @ssl_optional. When this is
present, no SSL redirection will happen, regardless of whether the
access comes in over http or https.

This decorator overrides @ssl_required, but for redability's sake,
never use both at the same time.
Wrong order of decorators

We really need to clean the code up so this does not matter...