Ooops. Spoke too soon. Still have csp errors when enabling apps (which actually are mixed content errors due to the call for app install being set as http.
Console error from work edge:
Refused to connect to 'http://cloud.andersens.xyz/apps/files/' because it violates the following Content Security Policy directive: "connect-src 'self'".
“Self” is https://cloud.andersens.xyz