Fix javascript loading for SSL embeds.

In production, liveupdate embeds are hosted on a off-cookie-domain. This
domain would also fail the is_reddit_url test which would mean that the base
URL wouldn't be set as secure even if the client connection was secure. This
would in turn cause javascript to not execute because it was loaded
insecurely.

I thought of a couple other ways to do this — changing `is_reddit_url` to allow `g.media_domain`, or adding a `force_protocol` option to `add_sr` — but both seem too heavy handed. I'm open to suggestions for better ways.

:eyeglasses: @spladug @umbrae