Describe the bug

URLs are sanitized with http, not https. This could lead to privacy loss / redirection / other attacks.

Steps to reproduce (I have confirmed I can reproduce this issue on the develop branch):

1. Create a field of type text_url
2. Open a page with that field
3. Enter google.com in the field
4. Save the page

Expected

https://google.com/

Actual

http://google.com/

Possible Solution

If the original URL didn't contain a protocol, use set_url_scheme() to set it to HTTPS.