https everywhere breaks this, because the 3rd party JS is loaded insecurely, and http://(xxx).heroku.com http://(xxx).heroku.com has a redirect rule to https://

https everywhere breaks this, because the 3rd party JS is loaded insecurely, and http://(xxx).heroku.com http://(xxx).heroku.com has a redirect rule to https://(xxx).heroku.com https://(xxx).heroku.com. The external scripts should instead be loaded securely, or using the same protocol as the main page.