force ssl

this is so that when we use the session-less mode (using the api_token)
the communication is encrypted. This is to avoid some hacker sniffing
the api token.

this is a security fix