Comment 27 for bug 1180297

While allowing http is less than ideal, since we're using a webkit engine riddled with security issues, I suppose it's the only thing we can do to allow facebook to work for now. Other providers are currently using http, so it's not as if we're reducing overall security.