- all external js files are loaded over https