use https for avatars and links to twitter & fb

fixes #147