provide a default in case httpUnsafeOrigin is not provided

www/common/outer/login-block.js

@@ -106,7 +106,9 @@ define([
         // 'block/' here is hardcoded because it's hardcoded on the server
         // if we want to make CryptPad work in server subfolders, we'll need
         // to update this path derivation
-        return ApiConfig.httpUnsafeOrigin  + 'block/' + publicKey.slice(0, 2) + '/' +  publicKey;
+        return (typeof(ApiConfig.httpUnsafeOrigin) !== 'undefined'?
+            ApiConfig.httpUnsafeOrigin: window.location.origin)
+            + 'block/' + publicKey.slice(0, 2) + '/' +  publicKey;
     };
 
     Block.getBlockHash = function (keys) {