we must never ever use hardcoded "http" for loading external content