Thumbnails should be served over SSL if needed

This may be a bigger issue that can fixed with a hook or filter, but this fixes it for plupload thumbs in public forms.