auth relevant stuff uses @ssl_required decorator

in production the decorator redirects to https URLs.
Implements the first two points of #247.
I wouldn't use it by default anywhere as for example the subdomains (versions) on appspot.com domains don't support https and from custom domains sometimes it takes time..