Use `Meteor.absoluteUrl()` to set ROOT_URL for cordova clients.

If we use `__meteor_runtime_config__.ROOT_URL` directly, as we were
previously, then we end up sending Cordova clients to http:// URLs even
if force-ssl is being used in the app. This is fairly bad on its own
(always sending cordova clients to http:// URLs instead of https://),
but made even worse by the fact that we don't set CORS headers on
force-ssl redirects (that is, the app breaks completely if the client
makes a DDP connection to an http:// URL for a force-ssl app).
Use TLS (not SSLv3) with phantomjs, to avoid POODLE problems

Also, args can be overridden using METEOR_PKG_SPIDERABLE_PHANTOMJS_ARGS