Tests that origin whitelisting for https does not match http URLs.