Use protocol relative script source

You otherwise have to "load scripts from untrusted sources" if you open the demo page via HTTPS.