we should force ssl  in the app and don’t rely on the webserver’s redirect rules.
Merge pull request #2058 from opf/feature/force_ssl

force ssl in production