Use protocol relative URL for script

Running the bookmarklet on an SSL page will cause a mixed-content warning.
This fixes it by loading the script in a protocol relative fashion.  Github
supports SSL for GH pages on the github.io domain.
Change to github.io

Github redirects all *.github.com urls to *.github.io.  Using the .io
domain avoids this redirect.
Use document.URL instead of location.href.

location.href on Safari has a bug where it cannot tell the difference between
a real # and an encoded #.  Since Safari does not support ResTiming, this isn't
an issue, but if at some point they do start supporting it, this could cause a
problem.

It turns out that document.URL is exactly the value of location.href, but w/o
the bugs.