assume media_player served from the same host, to ensure https compat