Default to using the scheme of the current page

Otherwise pages that work when accessed from `http` don't work when accessed from `https` because they suddenly start attempting cross domain access.