Prefer HTTPS for sending security tokens

We do not listen on port 80, we should encourage people to use TLS all
the time.