use relative URLs - this way http and https don't get mixed up