Secure option overrides window.location.protocol

When the secure option is truthy, the the URL prefix will be set to
https:// regardless of what the window.location.protocol is. When the
option is falsy, the URL prefix will be the same as the
window.location.protocol.
Fix tests follow change to secure urls under file:// change