After some tracing and debugging, I'm pretty sure that JUri::root and JUri::base will always give the Joomla configured URL when calling those functions, rather than the actual accessed URL. For creating URLs for images, download files, and links, this is fine. However, for any Javascript which may access a server side resource, this will cause the problem seen here.
Have a look at this code from Joomla's uri.php:
public static function base($pathonly = false)
{
// Get the base request path.
if (empty(self::$base))
{
$config = JFactory::getConfig();
$live_site = $config->get('live_site');
The first time this function is called, it sets up the base request path by getting Joomla's configuration, not by looking at the request URL. Thus, if the client requests the page from a different URL than what the configuration has been set to (like if the site is accessible from both HTTP and HTTPS), the JUri::base() will be different from the client requested protocol and/or host.
There are two places which need to be changed to support this. One is in default.php as you mentioned before. I found a different technique which should be more general though.
baseUrl: '" . ($_SERVER['HTTPS'] ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . '/' . "',
Also, utils.php needs to be changed in a similar fashion on line 312:
'baseUrl' => ($_SERVER['HTTPS'] ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . '/'
I would like to continue getting updates as needed. Can you explain what you mean by a "template override"?