fix dark captcha images
change behavior of asset upload so that extra paths show up first
avoid mixing content if the CMS is running secured