Bookmarklet: check and warn about the HTTPS problem

Add a check to the bookmarklet for detecting if we want to deploy on
a HTTPS page, and our code is hosted on the HTTP domain.

This combination is doomed to fail, since browser won't deploy code
hosted in insecure domains to secure pages. There is nothing we can do
about this, but we can at least detect this, and show a warning instead
of failing silently.

This fixes #289.