auth relevant stuff uses @ssl_required decorator

in production the decorator redirects to https URLs.
Implements the first two points of #247.
see the httpsify method, i took care of rewriting the domain name so it works with https...