Why (for what use cases) would one use the former? Browsers solve this by treating localhost as a secure context (i.e. no mixed content warnings etc.) even if you use plain http.