It’s still nice, if all the content is available over both http and http, to use protocol-relative URLs, i.e. without http or https before the //: part. It looks like the author has read your comment, and updated his source code to say <script src="//cdnjs.cloudflare.com/ajax/libs/leaflet/0.7.3/leaflet.js”> for leaflet.

http://www.paulirish.com/2010/the-protocol-relative-url/ describes how protocol-relative URLs work.