Protocol-relative URL breaks origin checks, use location.protocol.