Now, /publish/{edit,addeditor,login,logout} must be accessed via https://; other pages should not be (but can be).