modal thumbnails now served over https