…which is a long way of saying: JavaScript as usual, is brittle and that have trust in real urls for all these things.

(I saw ‘DOMException: “The operation is insecure.”‘ as the reason – in a FF private window with extensions turned off – if it helps)