Test for potential mixed content

[JohnONolan]

It's common to develop locally (http) and then deploy to production (https) - which means that it can be easy to miss mixed content warnings which don't show up in the console during development.

It would be useful for gscan to check for any assets being loaded over http and show a gscan warning for possible mixed content