I have an Open Data App Gallery showing applications hosted on servers with and without certificates. When displayed in the Gallery card, all launch URLs are prefixed with HTTPS regardless of what the registered URL. The search box works great, but just not the Gallery. I really like how I can dynamically update the page with the Gallery vs manually updating it. I tried making separate cards for the content, but it still forced the HTTPS.
Allow access to the organization through HTTPS only is unchecked in our AGO security settings.