Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

publish/addeditor.php

@@ -1,15 +1,13 @@
 <?php 
-if ( ! isset($_SERVER['HTTPS'])) {
-   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
-   exit;
-}
+require_once('../config.lib.php');
+require_https();
 require_once("../session.lib.php"); 
 $added = FALSE;
 $csrf_failed = FALSE;
 $hash_failed = FALSE;
 $exists = FALSE;
 if (!isset($_SESSION['editor'])) {
-  header("Location: https://xxx.org.za/publish/login");
+  header("Location: /publish/login");
   return;
 } else if (isset($_POST['adduser']) && !csrf_valid()) {
   $csrf_failed = TRUE;
@@ -73,7 +71,7 @@ if (!isset($_SESSION['editor'])) {
   <p><strong>The editor was not added: the editors.password column is too short for the password hash. Widen it to VARCHAR(255).</strong></p>
 <?php } ?>
 
-<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
+<form action="" method="post">
   <?= csrf_field() ?>
   <div class="grid">