title: How safe is it to use `//domain.com/` (schema-less) links?
body: <p>I've read some articles before that stated you can skip the scheme from your URLs and it'd be automatically determined from the page you're visiting. For example, if you're on <code>https://test.com/</code> and you'd have an image like <code>//google.com/logo.png</code>, the image would be requested through a secure connection. Unfortunately, I can't find any reference right now (damn you, bookmarks!).</p>
  
  <p>I tried it in Chrome and it worked. Tested on <code>https://google.com</code>:</p>
  
  <pre><code>(function (document) {
      var img = document.createElement('img');
      img.src = '//www.paypal.com/en_US/i/logo/paypal_logo.gif';
      document.body.appendChild(img);
  })(document);
  </code></pre>
  
  <p>Inspecting the elements, it brings in the logo from <code>https://www.paypal.com</code>.</p>
  
  <p>I've skimmed the <a href="http://www.w3.org/Addressing/URL/url-spec.txt" rel="noreferrer">URL RFC</a> but haven't found anything that clearly states this behavior. Does anyone know what the browser support for this feature is? I'm especially interested in mobile browsers.</p>