hopefully including fonts in a way that works behind https