avoid mixed http/https content