Serve site embeds from the site origin

Cloud Settings embeds load from the site's own path, so HTTPS sites no longer hit mixed-content failures.