Use a protocol-relative URL for embeds

…thus avoiding "insecure content" warnings on HTTPS-transmitted pages.