use https if a key is provided

If a user provides a key to the api, the endpoint must be https.