https was there from day 1. They're just using CloudFront so you would have to use the CloudFront url instead of the pretty one (which doesn't matter because visitors would never see it).