Canva itself is served via HTTPS and most browsers prevent HTTPS pages from loading scripts via non-HTTPS connections. Chrome and Firefox make exceptions for local servers, such as localhost, but ...
For example, during development, the backend is probably running on a localhost URL, but once the app's in production, the backend needs to be exposed to the internet. To more easily customize the URL ...