window.location and https