js refs need to be https