Hopefully this is how it should be

I wouldn't have deleted the test urls, nor the secure cookie probably (unless it's unused?).

This ruleset now doesn't secure http://lebsanft.org/ either - is this intended?

Oops let me fix that

Do I need a rule when the folder without www is just a symlink to www. Will this work for https-everywhere just fine? If yes, then I can just omit it.

The server adds the www with a 301, so that's fine

chronos@localhost / $ curl -I http://lebsanft.org
HTTP/1.1 301 Moved Permanently
Date: Fri, 17 Apr 2015 13:33:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.4.4
X-Pingback: http://www.lebsanft.org/xmlrpc.php
Location: http://www.lebsanft.org/
Connection: close
Content-Type: text/html; charset=UTF-8

chronos@localhost / $

then I guess this can be merged