Default to https for the CORS API.

Heroku uses Strict Transport Security (HSTS), which forces that all
requests to *.herokuapp.com must use HSTS. However. Chrome cannot read
the CORS response after a HSTS redirect due to https://crbug.com/387198.

Since the request is going to be redirected to https anyway, the demo
and the documentation will use https by default.

demo.html

@@ -64,8 +64,7 @@ textarea {
 </div>
 
 <script>
-  var protocol = location.protocol === 'http:' ? 'http:' : 'https:';
-  var cors_api_url = protocol + '//cors-anywhere.herokuapp.com/';
+  var cors_api_url = 'https://cors-anywhere.herokuapp.com/';
   function doCORSRequest(options, printResult) {
     var x = new XMLHttpRequest();
     x.open(options.method, cors_api_url + options.url);