fixed CSS load via HTTPS, because of mixed http vs. https