HTTPS everywhere, even in SVGs