update http client and fix log4j dependencies

Log4j dependencies were being pulled from http-client previously.

The latest http-client has better support for SSL so Im taking this chance to clean up dependencies.
scope test?