gae: fixed static content to not rely on scheme

These pages may be accessed with either HTTP or HTTPS,
although HTTPS is preferred.
js: use HTTPS for config page

to avoid access token leakage
gae: auth-failed: fixed comments, to avoid potential problems