to fix this i replaced:
function setRAWRBox(target,file) {
setName(file);
file = file.replace('+','%2B').replace('&','%26');
with:
function setRAWRBox(target,file) {
setName(file);
file = file.replace('+','%2B').replace('&','%26').replace('http','https');
this was in the rawr_default\code\rawr_previewbox.js, lines 106-108.
the only problem with this is that it then breaks the http mp3-streaming (however, if you're already using HFS with stunnel i assume this won't affect you much, as there is no point in not using a secure connection for everything).