Design improvements and fixes for mixed-content warnings when served via https