Correct and `redirect_to_secure` check

In some cases the domain and the secure domain would match. The correct
check would be to redirect whenever the current request is not secure.

This would work in cases when the domain and the secure domain differ as
well.