Use "protocol relative url".

Some browsers refuse (or just warn) when mixing secure and
insecure content.

So now the graph iframe will be loaded with either http or https,
depending on what the parent page is using.
Merge pull request #1174 from Stratopan/master

Use "protocol relative url".