use HTTPS-friendly CDN