The current default configuration for security.http.urls prevents resources.GetRemote from fetching assets from domains that begin with a digit (e.g., 1password.com, 37signals.com).

Suggesting changing this:

URLs: MustNewWhitelist(
	`(?i)^https?://[a-z]`,
	`! (?i)localhost`,
	`! (?i)^https?://[^/?#]*@`,
),

To this:

URLs: MustNewWhitelist(
	`(?i)^https?://[a-z0-9]`,
	`! (?i)localhost`,
	`! (?i)^https?://[^/?#]*@`,
),