Tab origin (should be EXTERNAL):
Firing requests at the loopback victim. Watch the CCD side, not this page — JS results here only tell you what the page could read, not what CDP captured.