Don't allow http repository urls

[eikek]

We should maybe not allow http (without the s) repository urls, because transporting credentials in clear.

See also #1095 (comment)

[leafty]

Not just that, but also, the contents can be intercepted and tampered with. The only safe way to have an http repository is when all commits are signed and the keys are distributed through secure channels.