Save flag and thank events on users now, not sessions
Note text in noscript tag #309
Redirect authenticated users to HTTPS pages