correctly detect https

location.protocol returns the scheme followed by a ':', per https://developer.mozilla.org/en-US/docs/Web/API/Location