Prefer HTTPS endpoint and pass api key in header

These changes are inspired by the Twitter gem and don't change the public API. I'm hoping this clears the way for more improvements like delegation to a persistent client instance and optionally passing an api key per request. Any feedback is appreciated. Thanks for taking a look!