use `window.location.protocol` so we can use ES behind SSL