README: add Ceveats for mixed http/https sites.