I am 90% sure this is a dumb question, but can't `location.origin` start with "https"?