def requires_https():
    def wrapper(func):
        if request.function == func.__name__ and not request.is_https:
            return request.requires_https()
    return wrapper

And then in the controller:

@requires_https()
def secret():
    return locals()