use HTTPS for URLs in su command

This prevents a man-in-the-middle attacker with access to modify the
HTTP traffic from injecting code that would be run as root.