use secure domain for script, but not for redirect
Merge branch 'master' into heroku-edition

* master:
  use secure domain for script, but not for redirect