Fix additional mixed-content warnings; always use client's protocol