moving app.js
cross scheme gotcha fixes

Can't communicate from http to https so all assets need to be served over https