use HTTPS to access img.shields.io
single message: use `_.escapeHTML(…)` around the header's properties