https all the things

This should fix insecure content warnings that some browsers may display