Two sites, same codebase mystery
The answer to this was that the dev site was being redirected to the live site, where the "https" was then crossed out, but the domain name remains, confusingly, the same.