API: force to HTTPS

unless running on localhost. *I need push this before I cantest this on
Heroku and Azure.*