Found it! The "HTTPS Everywhere" add-on causes this (may have something to do with CORS as well).