Prevent mixed content warnings from font loading
Add secure middleware to redirect to https

Piece of middleware that will redirect all non-api urls to https.

We're skipping the API urls for now so that backwards compatibility is
preserved for those that are currently using the API. The API is still
available over https, though.
Add force_https config variable

This defaults to false but when set to true the secure middleware is
used which redirects users to the secure version of the site.
Enable express' "trust proxy" setting

This means that express will set 'req.protocol' as 'https' based on the
value of the 'X-Forwarded-Proto' header.

See http://expressjs.com/3x/api.html#app-settings
Enable secure cookies
Allow base_url to take an optional path arg

This makes it easier to construct a url without having to do string
concatenation.
Use current url for API rather than hardcoding http

This exposes the base_url function to the templates to make it easier to
generate a url based on the current protocol/hostname.
Don't rely on the hosting_site_base_url being http
Show the correct protocol on create instance form
Use instance.base_url on new instance creation error

Exposes the instance.base_url to the template for use in error messages
when the instance creation has failed.
Always use https://popit.mysociety.org address
Use https urls in package.json where relevant
Fix incorrectly nested user/popit locals

These need to be at the top level rather than nested under config to be
consistent with where they were previously.
Templates should use same config as other code

Previously templates had a special config variable which came from
lib/middleware/config.js, this mostly matched the normal config object,
but had a couple of subtle differences such as having a
'hosting_site_base_url' property rather than 'hosting_server.base_url'.

This commit changes the config middleware to simply expose the whole
config object to the templates. This makes it easier to figure out which
bit of the config you should be using and also makes it easier to grep
for a config property and see where it's being used.
Only show Features PopIts on popit.mysociety.org

If people are self-hosting their instances then we don't want to show
Featured instances that don't actually exist on their hosted version.