correctly detect https

location.protocol returns the scheme followed by a :