zxcvbn-async.js using https