using "protocol relative urls" as per lecture 13 security recommendation.