Use X-Forwarded-Proto to determine is_secure

Use the X-Forwarded-Proto header to determine whether the request is
secure or not. This allows Stagecraft to correctly generate URLs to
itself.