Parameterizing protocol so we can use https instead of http

[cfe84]

I added an environment variable to override protocol so we can deploy the api with HTTPS and get rid of the mixed content errors

[benc-uk]

Another approach would be to use // rather than http:// that way the requests will match the origin either http or https depending on how the site was loaded

https://www.paulirish.com/2010/the-protocol-relative-url/