Use HTTPS everywhere

We've had a few complaints about this come in over the years, and I don't think using a Heroku-specific subdomain over an S3 URL is netting us all that much anyway.

Objections?

Fixes #58.

Supersedes #65.