I am trying to do perfect forward secrecy in an ExpressionEngine site. I have forced https to be used on all the pages using rewrite rules but the elements on the pages - images, js links, stylesheets etc - are coded using http and thus newer browsers give a message "Some unencrypted elements on this in the page have been blocked". The elements should be encoded with relative paths or with https absolute paths and are not. My developers tell me that they are encoded by ExpressionEngine and they can't change them. Is there any way to force ExpressionEngine to encode this in a more secure way.