handle REPOSITORY_GRAPHICAL being http as well as https
    
    I assumed the 'compose location' sent by fedmsg was https, but
    in fact it's http (you get redirected to https when you access
    it). Could just change the default back to 4, but why not make
    it properly robust. Sending without review so this doesn't go
    wrong all weekend.