fully support https with secure, httponly cookies

also change external resources (fb, robohash) to use https urls