Serve protocol agnostic script and iframe; fixes #4