…which is a long way of saying: JavaScript as usual, is brittle and that have trust in real urls for all these things.

(I saw 'DOMException: "The operation is insecure."' as the reason - in a FF private window with extensions turned off - if it helps)