demo not https - plugin page is not escaping chars