In index.php i suggest changing:
$static_media = "http://cdn.xfce.org";
$static_media = "//cdn.xfce.org";
That way if you test the website on https the media will also be transferred with https.
I can't see a problem with removing "http:" at first glance but someone might want to check that it does not break something.
Yes, it's already the case but never been committed. I need to update the git.