Make HTTPS iframe optional. Fixes #416