Any attempt to query a non-TLS server returns: "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection." I know this is now the default but I'm wondering since your tool is specifically for API diagnostics that it would be permitted :)