use only https links to external resources