Improve the dashboard experience when deploying to Heroku or other remote machines

[drew-gross]

Currently, deploying the dashboard to Heroku or similar services is awkward because we go to great lengths to ensure people don't accidentally leak their master key. This is useful, but can also make deploying difficult due to early SSL termination, untrusted proxies, and so on.

This would be a good first PR for someone new to the dashboard, but probably not so much to someone who is new to web security.