Tests that origin allowlisting for https does not match http URLs.