add working HTTPS; revise challenge parsing

- previous HTTPS "fix" didn't work at all
- challenge parsing now allows unquoted values