make sure remote assets are loaded with https
fixes #64