gravatar-image: serve image over https
bump README
environment.js: remove non-https gravatar img-src