[#994] Redirect (most) pages to HTTPS if we're on HTTP

* happens for both BML / Controller pages, with a few (temporary)
  special cases

* not for journal pages yet
Fixes #994.