SNI support

This still uses the 'default' site and dev-scripts from the previous PR, I'll fix that.

I changed `scripts/adduser.sh domain.com nginx` to `scripts/approve-user.sh domain.com nginx` to indicate that you should only run it *after* you have run `scripts/check-cert.sh domain.com` and seen that the cert is OK to import (without crashing haproxy for the whole server).