warn browser users loud and clear that only https is supported

oauth3.core.js

@@ -2,6 +2,10 @@
 ;(function (exports) {
   'use strict';
 
+  if ('undefined' !== typeof window && 'https:' !== window.location.protocol) {
+    window.alert("You must use https. We suggest using caddy as your webserver (or serve-https if testing locally)");
+  }
+
   var OAUTH3 = exports.OAUTH3 = {
     clientUri: function (location) {
       return OAUTH3.uri.normalize(location.host + (location.pathname || ''));