encrypt password/api-tokens

With only http the credentials (esp password/api token) are sent in plain text.

This changes communication to encrypted.