fix mixed content when served via https