Only allow https

Enforce the use of https in *all* requests to the API :cop: :guardsman: