How about removing the permissions for HTTP and keeping the HTTPS permissions? If the problem is "User Privacy Safety" as the rejection suggests, this seems to

How about removing the permissions for HTTP and keeping the HTTPS permissions? If the problem is "User Privacy Safety" as the rejection suggests, this seems to be the obvious choice.