Enforce https for everything (or to as much as possible). Look carefully to each of this:

• updates api
• installaddon api
• unit tests using us
• componentlib
• environment info
• timezone info
• lang packs
• local wwwroot
• moodlelinks filter
• ...