Testing both allow-same-origin and allow-scripts
Removing https