Force HTTPS on all images

// on Firefox translates into resource://, not http(s)://

Some of these are not strictly necessary (mainly the img src URLs
and the CSS that we insert in res_user.js), but there's no harm in
using all HTTPS