use https for external assets