updated app.js to reflect https everywhere