Making root application secure: always

This is so it can properly load and make API calls, which require https (and use protocol relative // in the application).