API: force to HTTPS

unless running on localhost. *I need to test this on Heroku and Azure.*