make request.is_secure() work

This fixes request.is_secure() and makes redirect() use correct schema.