Links to sandboxes are http hardcoded

We should either switch to https or make it configurable.