pilgrim.are.na does not use HTTPS

pilgrim.are.na lets you sign in to are.na, but over an insecure HTTP connection. this is a security risk!

[loup-brun]

Indeed, and the API URL is hard-coded to use the http protocole, see https://github.com/aredotna/pilgrim/blob/master/config.js#L10