Download via https.

It's safer to download via https; specially considering there is
no checksum test on the tarball to check that it's been tampered with.

See: http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/
Merge pull request #1578 from dkinzer/use-https

Download via https.