Oneboxed http link causes a TLS mixed content warning

If the original content is HTTPS there is nothing to do, a link will get oneboxed just fine.

For HTTP we have a open PR pending a test that will get merged soonish.