Security: use https for fetching artifacts

See http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/

This unfortunately still fetches some sbt stuff from http with doesn't have an https version :-(