force secure urls

force https. Fixes #2