require that CU_BOX_SERVER is on https

Our new "cobalt-dev in docker" is served on HTTPS, so we need to change the URL we use when talking to cobalt-dev.