fixes #1 - use https for API calls