bug fix: make all JavaScripts work via HTTPS, too

See the individual commit messages for details. Thanks to Gellert Sarosi for the original problem report.