non HTTPS compliant script