If I use `show source' I get (for example) @href values in an img element of:

https://app.box.com/representation/file_version_47563585445/image_2048_jpg/1.jpg

If I open that address directly, I get nothing; if I `show source' the nothing I get actual nothing. I suspect app.box.com shows fine to you because your browser has credentials that resolve the https connection. Since my browser instance doesn't, all is void and nothing.