This just came across on the ARCGIS BLOG from ESRI. Story Map apps will require all content placed in an app to use HTTPS in the URL. This switch to HTTPs only will take place later this year.
Read ESRI's detailed BLOG for more information, however the take-way from ESIR is this:
1) immediately adopt the practice of using HTTPS links for embedded content in new stories, and
2) begin the process of reviewing your existing stories to find and address HTTP links now.