Switched to using HTTPS URLs, since CORS is happy with that even from a non-HTTPS server locally. Closes #49.