I have submitted two feedbacks on this issue: FB20340722 and FB20446752.

Safari is the only browser that blocks mixed-content http://localhost requests. 😭 Source: https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content#browser_compatibility