Merge pull request #598 from kovshenin/https

Use protocol-relative URL for Google Web Fonts props @kovshenin
Merge pull request #645 from Automattic/wpengine-oauth-error

JSON API authorization: Fix error comparing signatures when the WordPres...
prevent error in post_login_form_to_signed_url

In some instances, when the `$parsed_url` doesn't have a `query`, the `post_login_form_to_signed_url()` function would emit a php notice and thus return an invalid result, which would then fail the signature checking process and thus the authentication flow would fail.

This prevents the "Someone may be trying to trick you..." notice to appear in the wrong context.

Discovered this bug while helping one of our API users debug an issue (see https://github.com/snarfed/bridgy/issues/161#issuecomment-45287830)
concat $url instead of overwriting it

props @justinshreve