don't try to embed iframes/objects from HTTP-only services