fn has_allowed_scheme(url: &Url) -> bool
Requests to a server supplied URL carry credentials and the user opens one in a browser, so only https will do. The fake servers of the tests have no TLS, hence http under test.