This is an enhancement to the current handling, where a 301 redirect is issued to "https://" URL using the same hostname as configured in the ".url" property of the config. This behavior may not always be appropriate.

Take Heroku for example. The SSL endpoint for a custom domain is a premium feature. So for free accounts custom domain (e.g. "www.myblog.com") is available via HTTP only. However, HTTPS is available via the default "https://myblog.herokuapp.com", using Heroku's domain for your app.

Since it is not desirable to access Ghost Admin via HTTP connection, the "http://www.myblog.com/ghost" should either be disallowed or redirect to "https://myblog.herokuapp.com".

Proposed features:

1. Add an ability to specify a redirect to different domain than the one in default .url property for Admin access
2. Add an ability to block access to /ghost folder for non-secure connections altogether (e.g. 401 Unauthorized response)

These are for when forceAdminSSL: true is set.