Don't assume http

Just use a protocol relative url. Works in all browsers, avoids mismatched protocol errors. The alternative (and not a bad one) would be to just always use `https` urls.