actually use https for download urls

The urls on sub-pages were all https, but not on the main page.