It would be a great improvement, if one could use local oauth2 endpoints or local links in general without HTTPS.

For me, this concerns the nextcloud integration specifically.

I would suggest to not throw 'http blocked' warnings if $CFG->ignoresecurity is defined and set to true, as done in the submitted patch, so that one can set $CFG->ignoresecurity = true in the config.php and continue developing happily ever after