Review: Auto Update [fix #18]

TODO:
- [x] sha instaed of md5
- [ ] sha computation in dist.js
- [x] refuse non https