What you are describing is correct behavior for Ajax: an "origin" is defined by the domain/protocol/port tuple, and so http://www.example.com http://www.example

What you are describing is correct behavior for Ajax: an "origin" is defined by the domain/protocol/port tuple, and so http://www.example.com http://www.example.com and https://www.example.com https://www.example.com are the same origin. What the parent comment is describing is a script tag which fails to load because its src is served over https instead of http.