Use correct scheme, fixes https X-domain issues