Optionally force https

This forces all non-api urls to redirect to the https version of the site when the `force_https` config variable is set to `true`. The API will still be available over https but we won't redirect to it so that existing clients using the http version will continue to work correctly. When we release a new version of the API (#620) then we can start forcing https.

Before this is deployed to production the `force_https` variable will need to be set for the popit.mysociety.org vhost.

Fixes #326