use request.scheme instead of hardcoded https

[benharri]

ran into a couple of these while testing locally, this will make it match whatever the app is currently running as