Switched to protocol agnostic links for css and js links in head.

This should stop the mixed mode messages we receive when the app is viewed over https.