Use req.protocol instead of hard-coded http

If the api explorer is served over https, the base path should use https.