use https instead of http for this link.

We redirect http to https, so it saves this redirect (and possible hijack)
when a client doesn't track HSTS

Reviewed by: eadler