Download via https.

It's safer to download via https; specially considering there is no checksum
test on the tarball to check that it's been tampered with.

See:
http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/