Adding back explicit HTTPS via window.location.origin