leaflet self-hosted so we can SSL