Added GAE requirements doc in security

Added the Google App Engine requirements.
Did you mean HTTPS, not HTTP/HTTPS? (Fairly sure plain HTTP works out of the box.)