use protocol relative urls for active content

switch the `http://` urls to `//` protocol relative urls
http://www.paulirish.com/2010/the-protocol-relative-url/

only applies to "active content" like `<script>` and `<iframe>`
https://developer.mozilla.org/en-US/docs/Security/MixedContent

solves #2