Always use https://popit.mysociety.org address
Use https urls in package.json where relevant