Use https URLs now that we have a proper certificate.

Mixing HTTP, HTTPS and CORS seems to be producing an exciting array of
strange issues, let's standardize on secure connections across the board.