Redirect HTTP to HTTPS

[rickr]

Anyone visiting any HTTP URL should be redirected from HTTP to HTTPS with the same URL and query params.

[tskuse]

@rickr, Would you mind taking a look at tskuse@3c1b456 ?

Enabling Express trust proxy:

(Recommend reviewing config options: http://expressjs.com/en/guide/behind-proxies.html. I'm not fully aware of the serving arrangement.)

Although the app will not fail to run if the application variable trust proxy is not set, it will incorrectly register the proxy’s IP address as the client IP address unless trust proxy is configured.

Setting a non-false trust proxy value results in three important changes:

• The value of req.hostname is derived from the value set in the X-Forwarded-Host header, which can be set by the client or by the proxy.

• X-Forwarded-Proto can be set by the reverse proxy to tell the app whether it is https or http or even an invalid name. This value is reflected by req.protocol.

• The req.ip and req.ips values are populated with the list of addresses from X-Forwarded-For.

[rickr]

That looks like a sane change. We can merge it in and test it out in prod before we launch this week.

[rickr]

Fixed in #95