fix HTTPS/mixed content issue