use protocol relative urls or https if possible