server needs to be https for cross site access from https sites. otherwise the browser will block the request.