Now using HTTPS instead of HTTP, reqs from injected.js are now allowed