use protocol-relative URL for web font, to avoid mixed content warnings