Retrieve box using HTTPS

Vagrant does not currently perform SSL certificate validation, but this way
we'll at least be ready when that gets implemented.

Also added comment about how to download box securely.

Change-Id: I52924603e85c70732e272e8b5719d3f977fe6bbd