One debugging shortcut that saves a lot of guessing: log what the application thinks the request scheme and host are, on one request, temporarily.
Every discussion of this ends up being an argument about what the app sees, and the app can simply be asked. Print the effective scheme, host and origin at the top of a view, submit one form, read the log, and you know immediately whether the proxy headers are arriving and whether the app is honouring them.