Use HTTPS in all cases for the default assets URL

There is no reason not to use HTTPS.