Secure option overrides window.location.protocol

When the secure option is truthy, the the URL prefix will be set to https:// regardless of what the window.location.protocol is. When the option is falsy, the URL prefix will be the same as the window.location.protocol.

This request pertains to Issue #17, if you're interested in the changes, that would be great!

Thanks