1.2M6: Granular HTTPS Support

Xaraya currently produces either all HTTP or HTTPS URL's, according to 
the config setting Site.Core.EnableSecureServer, accessed via 
base-admin-modifyconfig.

Sometimes it is useful/desirable for site admins (or module authors) to 
enable secure connections only on a select few URL's, especially during 
login, account modification, or other security-sensitive operations, 
such as shopping cart checkout.

In order to enable this, we have two options: modify the definition of 
xarModURL, or introduce a wrapper for it that would enable the secure 
protocol.

xarModURL takes the following arguments:

$modName = NULL: registered name of module

$modType = 'user': type of function

$funcName = 'main': module function

$args = array(): array of arguments to put on the URL

$generateXMLURL = NULL: generate in XML format

$fragment = NULL: document fragment target

$entrypoint = array(): arguments for different entrypoint than index.php

The new param would be: $secure = false

But where does it go?  The least disruptive place would be at the end, 
however that forces the least used arguments $(generateXMLURL, 
$fragment, $entrypoint) to be passed.  The logical place, IMO, is after 
$args.

To avoid the above conundrum, we can add a new API wrapper for 
xarModURL.  The new xarModSecURL would take the same arguments as 
xarModURL, call it, and perform a string replace on the returned value 
if Site.Core.EnableSecureServer is disabled (in this case, the resulting 
URL is already secure).

The second option was privately requested by Autocrat in January, and 
provided to him as a "hack", apparently with no adverse effects.

I prefer the latter solution... opinions?

See: http://www.xaraya.com/index.php/xarbb/topic/3403