Split out HTTPS and HTTP bookmarklet origins

The HTTP bookmarklet origin is only needed/valid in IE (since IE warns
when showing secure content on insecure pages).