Experimental change to force SSL on authenticated users

This commit is untested with sites with secure_site, but guarantees
that the changes here are fully backward-compatible when the secure_site
configuration is not set.
Try to use the canonical in the right way.

Probably there are bugs hiding around
Added configuration option for SSL
Retrieve the list of vhosts. Safe change
Generate ssl stanzas for each site and create certificates if needed
Provide a migration script
Added upgrade note
Ignore heavy directory
Use a parameter instead of the session to redirect after login

This fixes some weirdness
Added some tests
Added test for SSL
Switched tests to use https by default
Silenced spammy warning
Merge branch 'secure-sites'
Usual mess