migrate all API calls to HTTPS, closes #149