https support

fix js includes to work even if the site is served over https