Secure admin pages with basic authentication

- Add environment variable configuration support so that variables
  (particularly ones with sensitive data) do not have to go in the YAML
  file (which is under source control)
- Enable HttpsEnforcer for the admin filter chain in the configuration