allow abort

abort(403) if an HTTP connection is made when expecting HTTPS

This will force clients to use HTTPS. If they added auth credentials in the params or body they would have been visible from the initial insecure request.