It was a security policy thing, for https, it blocked external services, including google fonts and google analytics and google adsense.
Added the following meta tag for people to use in the future:
<meta http-equiv="Content-Security-Policy" content="style-src 'self' 'unsafe-inline' http://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com;">