varnish: refuse https except on /login
haproxy: temporarily enable https on external interface
rebind https on internal interface
haproxy: bump up session TTL
only allow HTTPS for POST on /login
Merge branch 'master' of /srv/infrastructure