public.json: Drop the HTTP scheme (only allow HTTPS)

I see no reason why we couldn't serve unauthenticated requests over
HTTP, but that might make it harder to keep folks from accidentally
making authenticated requests over HTTP and leaking their credentials
and our data.  In any case, our current Nginx proxy setup is pushing
everything over HTTPS, so just point users in that direction for now.