Getting an SSL certificate (Emmanuel is working on that)
For now we'll use a self-signed certificate
Make sure the stuff that requires a session is using SSL only (done)
I'll use apache mod_rewrite for that because otherwise it's error-prone at the software-level. We know all the public paths and we'll redirect for anything else
Make sure the session cookie is only used on HTTPS (done)
Make sure the ceylon tools grok HTTPS (done, they do if you trust the certificate)
This requires a few things: