add note about third-party JS, CDNs, and HTTPS

BS3 commits: 3e9e339ee3140c44e1d3948981a551c16f22b1a9