title: History.js and Same Origin Policy traversing to SSL
body: <p>I'm using <a href="https://github.com/balupton/history.js" rel="nofollow noreferrer">history.js</a> and trying to push a state change from a HTTP site like:</p>
  
  <blockquote>
    <p><code>http://www.example.com/some/resource</code></p>
  </blockquote>
  
  <p>... to my secure site (payment page), like:</p>
  
  <blockquote>
    <p><code>https://www.example.com/payment/for/some/resource</code></p>
  </blockquote>
  
  <p>... but I'm getting this error in Safari:</p>
  
  <blockquote>
    <p>SECURITY_ERR: DOM Exception 18: An attempt was made to break through
    the security policy of the user agent.</p>
  </blockquote>
  
  <p>... when trying to push the state change like:</p>
  
  <pre><code>History.pushState(null, null, new_state_url);
  // new_state_url = https://www.example.com/payment/for/some/resource
  </code></pre>
  
  <p>Doing some digging around, I found <a href="https://stackoverflow.com/questions/6351447/html5-push-replacestate-and-the-base-tag-causes-security-exception">this SO question</a>, which suggests that I'm running afoul of the <a href="http://en.wikipedia.org/wiki/Same_origin_policy" rel="nofollow noreferrer">Same Origin Policy</a>, since I'm trying to push a state change across protocols. The suggested answer there (if I understood correctly) was to explicitly push the full URL, but I'm already doing that and getting the same error.</p>
  
  <p>In context, I'm building a mobile version of my site and would like the payment page to load using the same AJAX that I've built around all my other page-loads (I've built my page loader with jQuery's <code>$.ajax</code> and some custom animation, roughly similar to what you might find in <a href="http://jquerymobile.com/" rel="nofollow noreferrer">jQuery Mobile</a>).</p>
  
  <p>Is it possible for me to push this state change across SSL? If so, how do I do this?</p>