diff --git a/static/js/app.js b/static/js/app.js
index 21376a4..804775c 100644
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -157,7 +157,9 @@ function customPrompt(message, defaultValue = '') {
 function playStation(url, name, stationId) {
   stopPlayback(false);
 
-  if (location.protocol === 'https:' && url.startsWith('http://')) {
+  // A secure page can't load plain-http streams (mixed content). Native shells
+  // that play the stream themselves set window.DIORA_PLAYS_HTTP_STREAMS.
+  if (location.protocol === 'https:' && url.startsWith('http://') && !window.DIORA_PLAYS_HTTP_STREAMS) {
     window.open(url, '_blank');
     return;
   }
@@ -280,15 +282,18 @@ async function startPlaySession(stationName, stationUrl) {
 }
 
 async function stopPlaySession() {
-  if (!currentPlayId) return;
+  // Take the id before awaiting: playStation() calls this without waiting and
+  // starts the next session right away, whose id must not be cleared here.
+  const playId = currentPlayId;
+  if (!playId) return;
+  currentPlayId = null;
   try {
     await fetch('/radio/play/stop/', {
       method: 'POST',
       headers: {'Content-Type': 'application/json', 'X-CSRFToken': getCsrfToken()},
-      body: JSON.stringify({play_id: currentPlayId})
+      body: JSON.stringify({play_id: playId})
     });
   } catch (e) {}
-  currentPlayId = null;
 }
 
 window.addEventListener('beforeunload', () => {
diff --git a/static/js/sw.js b/static/js/sw.js
index c36b133..e20bf19 100644
--- a/static/js/sw.js
+++ b/static/js/sw.js
@@ -2,7 +2,7 @@
  * diora service worker — caches the app shell for offline use.
  */
 
-const CACHE = 'diora-v48';
+const CACHE = 'diora-v49';
 const PODCAST_CACHE = 'diora-podcast-v1';
 const SHELL = [
   '/static/css/app.css',