readme: clarify that response is passed as context

Also use https for badges & links.