protocol-less <script> src for https support