Bug 1091261 - Implement login 3.0

Hmm, this seems a very brittle thing. I'd strongly advocate going for `!!process.env.FORCE_SSL` and leaving the FORCE_SSL var empty in the .env rather than the string "false", because "cake", "bunny" and anything else would also be treated as false, which is weird.