Why can't it just use a https origin? :P