use a static asset host if configured
use secure_headers gem
check for empty string