Support forcing HTTPS for oauth redirect URLs

Using HTTPS improves security since it prevents an attacker from
seeing the request, which includes the oauth access token.

On development, we care less about this and it's simpler just to use
http, so I made it a setting.