themes/base: fix xhr.js for https:// access