all resources through https, prevent image from drag