Failed xhr.open gives BadUrl, but may be caused by security restrictions about http HOT 3 OPEN

Thanks for the issue! Make sure it satisfies this checklist. My human colleagues will appreciate it!

Here is what to expect next, and if anyone wants to comment, keep these things in mind.

from http.

Can you say more about exactly what the error you saw was? To capture it and state it explicitly, I must be able to reproduce it.

from http.

Yes, the alert shows:

It is a screen shot from the android emulator. It also occurs on the device.

For reproducing it you have to install cordova (https://cordova.apache.org/#getstarted) and add the android platform.
Then I tweaked the example app (https://cordova.apache.org/docs/en/latest/guide/cli/index.html) such that the example www/js/index.js embeds the JavaScript code of my Elm app.
The content security policy element within the index.html is
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *; img-src 'self' data: content:;">
I hope this helps.

from http.