It doesn't work if you haven't set the Access-Control-Allow-Origin header.

You just see a response - or maybe not - depending on the browser you use.

Chrome shows <pre>0 error</pre> as response headers and Firefox shows <pre>0 [Exception... ""  nsresult: "0x805e0006 (<unknown>)"  location: "JS frame :: https://domain.local/docs#get--latest :: .send :: line 592"  data: no]</pre>

I anyways can't really differ between routes forced to http, or routes, where both (secure and unsecure connections) are allowed. Therefore I'd rather keep it like that.