Use https in embedded forms, since it allows logged-in users to properly view materials that are otherwise forbidden.  Unfortunately this doesn't work when we ping the server for a PID,  since at that time, we're not actually logged in.  See Utils.ping_islandora_for_object(...) for a possible work-around.