Allow loading map tiles when HTTPS is not used

I noticed that the recent changes to CSP in order to avoid notices when using HTTPS, blocks map tiles from loading. So now the map tile URLs are added conditionally. 
Pls, note that this is untested under HTTPS; I do not have an environment with HTTPS.