Fix OneBusAway#992 - Target API Level 28 (Android 9.0)

Also update custom server testing docs to reflect need to use HTTPS

CUSTOM_SERVERS.md

@@ -5,7 +5,7 @@ this feature to try out a new test server that you've set up, but aren't ready t
 
 Before doing anything, check out the [system architecture diagrams](SYSTEM_ARCHITECTURE.md) to understand how OBA Android communicates with other servers. and what features they provide.
 
-Also, note that while you can test your OBA server with a HTTP URL, you'll need to enable SSL for HTTPS before launching in the Regions API.
+Also, note that while you can test your OBA server with a HTTP URL (see section below), you'll need to enable SSL for HTTPS before launching in the Regions API.
 
 ## Configuration
 
@@ -16,14 +16,20 @@ In the app, go to "Settings->Advanced".  You should see a screen like:
 You can use the following directions to add a custom OneBusAway API server and/or a custom OpenTripPlanner
 server.  After entering the server name and path, hit the back button twice to exit the Settings screen, and the app will re-initialize with the new URL(s).
 
+### Testing without SSL
+
+We strongly encourage you to configure your server to use SSL for secure communication via HTTPS - this is required for launching as a new region in the Regions API due to requirements in Android and iOS.
+
+If you want to test a server without SSL enabled, you'll need to build your own version of this app with an edited [`onebusaway-android/src/main/res/xml/network_security_config.xml`](onebusaway-android/src/main/res/xml/network_security_config.xml) file to add an exception for your server. This is an Android restriction for plain text HTTP communication - see https://developer.android.com/training/articles/security-config for details.
+
 ### OneBusAway API Server
 
 You can enter a server URL in a few different formats, including:
 
 * `example.onebusaway.org`
 * `example.onebusaway.org/onebusaway-api-webapp` (if you deployed to the default path)
-* `http://example.onebusaway.org`
-* `http://example.onebusaway.org/onebusaway-api-webapp`
+* `https://example.onebusaway.org`
+* `https://example.onebusaway.org/onebusaway-api-webapp`
 
 ### OpenTripPlanner API Server
 

onebusaway-android/build.gradle

@@ -52,7 +52,7 @@ android {
 
     defaultConfig {
         minSdkVersion 16
-        targetSdkVersion 26
+        targetSdkVersion 28
         versionCode 116
         versionName "2.6.7"