Require HTTPS (session protection) if supported.

Deployment tools will enable (force) HTTS protection for session cookies
if they detect the wildcard cert that enables HTTPS support in Apache.
In this case, all requests with an active session (even anonymous) will
go through HTTPS, with smart exceptions for OAuth redirect_uri in HTTP.
This lets us support insecure dev setups at the cost of possible
session hijacking (caveat user). Addresses #419 and #307.
Fix untested(?) deployment code for HTTPS support.

Addresses #409, #419, #307.
Merge pull request #513 from OpenTreeOfLife/webapp-https-support

Force HTTPS (session protection) in web2py