fix mixed content warning under HTTPS