Force usage of SSL in redirect uris

Since OAuth2 does not implement any encryption itself and relies on SSL for transport security, it is wise to use HTTPS in communication instead of HTTP. Unencrypted communication allows intercepted data to be easily read. And furthermore an access token or other credentials to be easily misused. This pull request adds an option force_secured_redirect_uri to the configuration and forces the usage of https in redirect uris. This is not a complete pull request, but leaves room for (code) improvements and discussion such as:

* should https be required as default in redirect uris?
* any better name for `force_secured_redirect_uri`? 
* other protocols other than https?
Should we make it default to `true` only if env is production?