Oauth discovery advertises http urls behind an https proxy

`/.well-known/openid-configuration` advertised http URLs behind an SSL-terminating proxy; now respects `host_name` in site_config.json.