use protocol-relative URL

instead of fixed URI scheme (http:) to stop the message: "The page
*.html ran insecure content"