use httpsLs for external profile picture URLs