Fixes #42: Use a protocol-agnostic URL for OBI_BASE_URL so issuer.js gets loaded from https