fixed http > https for externally loaded resources