We attempt a CORS fetch to read headers. If blocked, we can only confirm HTTPS usage.