gae: changed all pages to use HTTPS

Access/refresh tokens may, if intercepted, grant access to user's
private data.