add note about third-party JS, CDNs, and HTTPS
Merge pull request #11137 from twbs/explain-https

add note about third-party JS, CDNs, and HTTPS