I think we need this to be `://` to make sure that OAE and the downloaded font are using the same protocol and avoid unsafe content messages.