protocol agnostic reference to font' + fixed SSO

This fixes some warnings about insecure content on a secure pages, as google also offers https-endpoints for their API.