use HTTPS only when not in development and behind Heroku's LB
moves all vendor js to vendor folder
forces post object urls to use the current page protocol
fixes merge conflicts
Merge pull request #14 from jonjchew/force-https

Force https