So how would I use Hug as a secure public API -- https, authentication, authorization? Would I read up on Falcon? Are there any examples you could point to of how that might be done?
Is there a https example? Personally I think all examples online should use ssl by default these days. http should be banned altogether.
That's not how things work when using any WSGI based framework, the SSL part should be handled by either uwsgi / gunicorn or nginx. Development servers (hug or Flask or any other) should basically never be used directly. Examples can, and should be done using HTTP to allow local testing.