readme: Use HTTPS