Don't rely on browser to auto-add protocol to //hostname/path URLs.

It works, but apparently XHR protection fails sometimes in Chrome because
the allowed origin header is compared against the wrong string, or
something.