Add force_https config variable

This defaults to false but when set to true the secure middleware is
used which redirects users to the secure version of the site.
Enable express' "trust proxy" setting

This means that express will set 'req.protocol' as 'https' based on the
value of the 'X-Forwarded-Proto' header.

See http://expressjs.com/3x/api.html#app-settings
Enable secure cookies