bump to v0.4.x and enforce https - closes #30