feature: handle realitve URL

When checking AJAX requests to ensure that HTTP Basic authentication credentials are not sent in the
Authenticate header for non-HTTPS requests, resolve relative URLs to an absolute URL and check the
protocol, rather than treat requests with relative URLs as non-HTTPS requests.