Switch to https for API calls & use protocol-less img urls

Fixes https://github.com/habari/system/issues/70 in trunk/head