Make Qvitter work when `SSL sometimes' sites load it w/out SSL

Using HTTPS URLs from a non-HTTPS site can make browsers think
that there's a cross-site issue, for example when loading JSON data
via qvitter HTTP API calls (which makes the browsers block the data,
which breaks Qvitter).

So let the site config decide whether to use HTTPS or not;
on `ssl = sometimes' sites, generally try to use HTTPS only when
it's consistent with how the current page is being loaded
(which is consistent with what the main GNU Social code does).
Don't insert extra whitespace in queetbox.
autocompletion: use avatar URLs, not filenames.

Not all avatar-providing plugins generate a local filename;
just using a pregenerated URL is safer.
Fix autocomplete overflow on condensed view