Use protocol-neutral javascript references

This fixes Mixed Content problems when serving via https.