Repository: bokeh/bokeh

Issue:
bokeh server url hard coded as over  http.
#### ALL software version info (bokeh, python, notebook, OS, browser, any other relevant packages)
bokeh: 0.12.6
#### Description of expected behavior and the observed behavior
In function `_show_notebook_app_with_state` of `io.py`, the url for `autoload_server` is hard coded as http. Maybe an option can be developed to choose https where secure communication is required.



Discussion:
Now here:

https://github.com/bokeh/bokeh/blob/master/bokeh/io/notebook.py#L442

Resolving patch:
diff --git a/bokeh/io/notebook.py b/bokeh/io/notebook.py
--- a/bokeh/io/notebook.py
+++ b/bokeh/io/notebook.py
@@ -424,7 +424,17 @@ def publish_display_data(*args, **kw):
 
 @internal((1,0,0))
 def show_app(app, state, notebook_url):
-    '''
+    ''' Embed a Bokeh serer application in a Jupyter Notebook output cell.
+
+    Args:
+        app (Application) :
+
+        state (State) :
+
+        notebook_url (str) :
+
+    Returns:
+        None
 
     '''
     logging.basicConfig()
@@ -433,13 +443,15 @@ def show_app(app, state, notebook_url):
     from ..server.server import Server
 
     loop = IOLoop.current()
-    server = Server({"/": app}, io_loop=loop, port=0,  allow_websocket_origin=[notebook_url])
+
+    origin = _origin_url(notebook_url)
+    server = Server({"/": app}, io_loop=loop, port=0,  allow_websocket_origin=[origin])
 
     server_id = uuid4().hex
     curstate().uuid_to_server[server_id] = server
 
     server.start()
-    url = 'http://%s:%d%s' % (notebook_url.split(':')[0], server.port, "/")
+    url = _server_url(notebook_url, server.port)
 
     from ..embed import server_document
     script = server_document(url)
@@ -481,6 +493,9 @@ def show_doc(obj, state, notebook_handle):
 _NOTEBOOK_LOADED = None
 
 def _loading_js(resources, element_id, custom_models_js, load_timeout=5000, register_mime=True):
+    '''
+
+    '''
     from ..core.templates import AUTOLOAD_NB_JS
 
     return AUTOLOAD_NB_JS.render(
@@ -494,6 +509,23 @@ def _loading_js(resources, element_id, custom_models_js, load_timeout=5000, regi
         register_mime = register_mime
     )
 
+def _origin_url(url):
+    '''
+
+    '''
+    if url.startswith("http"):
+        url = url.split("//")[1]
+    return url
+
+def _server_url(url, port):
+    '''
+
+    '''
+    if url.startswith("http"):
+        return '%s:%d%s' % (url.rsplit(':', 1)[0], port, "/")
+    else:
+        return 'http://%s:%d%s' % (url.split(':')[0], port, "/")
+
 #-----------------------------------------------------------------------------
 # Code
 #-----------------------------------------------------------------------------
diff --git a/bokeh/io/showing.py b/bokeh/io/showing.py
--- a/bokeh/io/showing.py
+++ b/bokeh/io/showing.py
@@ -86,9 +86,10 @@ def show(obj, browser=None, new="tab", notebook_handle=False, notebook_url="loca
             When showing Bokeh applications, the Bokeh server must be
             explicitly configured to allow connections originating from
             different URLs. This parameter defaults to the standard notebook
-            host and port. If you are running on a differnet location, you
+            host and port. If you are running on a different location, you
             will need to supply this value for the application to display
-            properly.
+            properly. If no protocol is supplied in the URL, e.g. if it is
+            of the form "localhost:8888", then "http" will be used.
 
             It is also possible to pass ``notebook_url="*"`` to disable the
             standard checks, so that applications will display regardless of


Test patch:
diff --git a/bokeh/io/tests/test_notebook.py b/bokeh/io/tests/test_notebook.py
--- a/bokeh/io/tests/test_notebook.py
+++ b/bokeh/io/tests/test_notebook.py
@@ -115,3 +115,13 @@ class Obj(object):
 #-----------------------------------------------------------------------------
 # Private API
 #-----------------------------------------------------------------------------
+
+def test__origin_url():
+    assert binb._origin_url("foo.com:8888") == "foo.com:8888"
+    assert binb._origin_url("http://foo.com:8888") == "foo.com:8888"
+    assert binb._origin_url("https://foo.com:8888") == "foo.com:8888"
+
+def test__server_url():
+    assert binb._server_url("foo.com:8888", 10) == "http://foo.com:10/"
+    assert binb._server_url("http://foo.com:8888", 10) == "http://foo.com:10/"
+    assert binb._server_url("https://foo.com:8888", 10) == "https://foo.com:10/"