Change the default from opt-in to opt-out, so if you're using the
default config, ie no "secure: True/False" field set, then we now
default to True rather than to False. So users can still opt-out by
setting "secure: False" in the hackage repo section, like:

repository hackage.haskell.org
  url: http://hackage.haskell.org/
  secure: False