norm.css.dsp loads two PNGs from the wild:

background-image: url('http://www.zkoss.org/zk/img/${z:encodeWithZK("zkpowered.png")}')
background-image: url('http://www.zkoss.org/zk/img/${z:encodeWithZK("zkuptime.png")}')

For starters, ZK shouldn't call home like this. Secondly, the ZK webapp may not have a route to the wild. Thirdly, this causes mixed content warnings when running under HTTPS.

Please load these images from within the webapp, and not make remote calls for them.