server: update forced TLS redirect logic
server: update forced TLS redirect logic

Previously, one could check for r.TLS != nil in a request handler
to identify whether a client made a plain HTTP request or over TLS.

Apparently, this has stopped working at unknown time and r.TLS is now
always nil. In fact, no documentation on
https://cloud.google.com/appengine/docs/go/ suggests anything pertinent
or I somewhow missed it.

However, the following page for "flexible" environment suggest the
existence of X-Forwarded-Proto header:
https://cloud.google.com/appengine/docs/flexible/go/how-requests-are-handled

Trial and error confirmed this seems to work also for the standard
App Engine environment. Who knows for how long though.

google/weasel