force https for external images.  upgraded lodash