Use https only

Default to https only, since logins are passed now via basic
authentication.