Both http and https work fine for me.
Pale Moon on Debian
Not that it matters, but:
After a bit of investigating I think I have it figured out. Seems the
server is configured to prevent "hot-linking". When you visit the https
version the server sees the referrer as coming from the https version
which is a "different site", so it gives the 403 error on the images.
I have my Pale Moon browser configured to "never send referrer" so it
works fine for me. It is just a minor problem with the server
configuration.