Interesting, it's in the HSTS preload list, so you have to use https as a .app domain!