Sanitize non-https images even with USE_SSL=false

Since we run behind a proxy in production now, we always have
UNHANGOUT_USE_SSL=false.