Refuse to return http hostmeta data if httpsOnly flag is set

Closes #12.