temporary hotfix for ssl problem: include iframe via http