add option to disable mixed content security, workaround for ajax restrictions