Use HTTPS or protocol-agnostic URLs.