Document https redirection setting for authentication.

Should production.py be updated with this set to `True`?