7 allow cross-origin framing CORS module
https and http -- even if the host is the same -- are considered different domains.

The way you can deal with that when your site can be viewed with both https and http, is instead of referencing files 
https:// or http://
just use //
It will defer to the protocol that you are on.

The only time this would cause problems would be if a certain resource only got served up under secure or insecure. But this does not sound like it would be a problem for you in this instance.

EDIT:
In order to change existing content, which it sounds like doing by hand is impossible. You could try a module like https://www.drupal.org/project/scanner -- being careful to backup, test, and make sure you are only looking at the correct URLs (you don't want to change the urls where changing the protocol would be).

One other possible way to make it work is to just make your path references root relative -- strip out http://yourdomain.com - and just leave /your/path/to/file

The other thing to do is just cherry pick the content that people are looking at most.