https everywhere breaks this, because the 3rd party JS is loaded insecurely, and http://(xxx).heroku.com has a redirect rule to https://(xxx).heroku.com.

The external scripts should instead be loaded securely, or using the same protocol as the main page.