Make `force_ssl` and `secure_cookie` options configurable

Currently, in order to allow access to the (Admin, Master, Developer) portals via http it is necessary to configure the `force_ssl` and `secure_cookie` settings to `false` in `config/settings.yml` manually with a configmap.

Multiple customers need to configure these (e.g. because they do SSL offloading), so the request is to make these configurable via environment variables.
If there is no particular reason to have different values for these two parameters, the environment variable could be just one.