use protocol-less links to external libs

(also update to most recent stable Leaflet)