Changing production from false to true should force new cert

[davidc]

It should look at the existing cert and see if it's test and we've requested production (or vice versa) and if so, the admin has switched environment, so we should add the force flag.

This may be better done by getssl itself