smpcwallet.com doesn't work over HTTPS because of mixed content

[Iruwen]

Mixed Content: The page at 'https://smpcwallet.com/#/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://1.2.3.4:4449/'. This request has been blocked; the content must be served over HTTPS.

While the communication between cross-chain bridge and dcrm node doesn't have to be secured as it's a local connection (until it's not), the wallet must be accessible securely so it's not susceptible to MITM attacks like interception, injection and other forms of manipulation. Sooner or later browsers will disable unencrypted connections altogether, they already issue a warning.
The current state seems like a workaround to avoid the need for TLS termination on dcrm node RPC endpoints? RPC communication needs to be secured as well, obviously. I have a few ideas how to fix that, just don't wanna start working on it if I'm missing something here.