make embapp iframe http/https when necessary, closes #114