Ref T6706. Ref T2783.

• In the long run, I want to allow authentication artifacts to be restricted to specific IP ranges (for example, a bot's Conduit token might only work if the bot is on the corporate network).
• Right now, I want to require HTTPS only for calls from outside the Phacility network. Calls between boxes get to use HTTP so we don't have to deal with the SSL for now / maybe ever.

Wrote a pile of test coverage.