SSL is one line on Rails - Just do it!

config.force_ssl = true

I'm so surprised at how easily Rails allows you to incorporate security.
Thumbs up, Rails!

Edit: Have to jump through a few hoops to add SSL to a custom domain but testing on Heroku is hassle-freeh
https://devcenter.heroku.com/articles/ssl

http://ruby.railstutorial.org/chapters/sign-up#sec-deploying_to_production_with_ssl