So for someone coming along reading this, it looks like x-forwarded-protocol has something to do with load balancers.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
I'm not using one BUT I think my requests are being forwarded anyways. I am testing my Phonegap/cordova app using the Ripple browser plugin, I bet that does some forwarding. And when my app, built via phonegap build with hydration mode... I guess there's some forwarding there too.
So my hacked solution for now is to update the setupConfigVariables() function, and set
$GLOBALS['_MAX']['SSL_REQUEST'] = false;
Guess I won't be able to do any SSL requests but I don't think I will anyways.