Use protocol relative calls to youtube.com to avoid mixed security error