tweak index.html
adding simple support of process.env.APPROVED_API_KEY
always use https with api key