code: private boolean isTransportSecure(HttpServletRequest req) {
  		String url = req.getRequestURL().toString();
  		if (req.getScheme().equals("https")) {
  			return true;
  		}
  
  		String value = req.getHeader("X-Forwarded-Proto");
  		if (value != null && value.toLowerCase().equals("https")) {
  			return true;
  		}
  		return false;
  	}
docs: determine if transport is secure. Either the protocol must be https or we
  must see a forwarding header that indicates it was https upstream of a
  proxy. Use of a configuration property to allow plain http was rejected
  in review.
  
  @param req
  @return