detect request scheme rather than guess https

Because ``_scheme='https'`` is completely retarded.

Also needs (already present on leviathan):

```nginx
proxy_set_header X-Forwarded-Proto https;
```

inside `location {}`.