Use "protocol relative url".

Some browsers refuse (or just warn) when mixing secure and
insecure content.

So now the graph iframe will be loaded with either http or https,
depending on what the parent page is using.