Legacy Fixes - Various (Https, paid Heroku, GDPR etc.)

[SleepySheepy172]

• Use paid Heroku plan, so site doesn't "sleep" (significantly improve load times for visitors if traffic volumes are low) - this would be done by Hilary/Sleuth

• Enforce https redirect (i.e. if someone tries to visit the non-https version, get redirected - possibly useful tutorial) - requires paid Heroku plan

• GDPR compliance check required?

• Cookie notice required? (don't think so, as they're not third party)

• More in-depth security "audit" and confirmation of limitations, improvements, etc with Hilary

Moved from End of Sprint bug Issue #107