A few small fixes

* allow HTTPS URIs
* don't HTML escape errors that go to the console
* get rid of log4j warnings