HTTP to HTTPS stream correction

The urls are completely being re-written, hence my attempt to catch the call for an http:// in the tcp stream and replace it with problem is that it's not working

I may be missing something, but what you originally described indicates that you are likely NOT rewriting all of the URLs. If the browser is attempting to make http:// calls back to the server, it's getting that information from somewhere... The purpose of the client side capture is to determine the exact point in which the browser is doing that, where it's trying to go, and subsequently which previous response gave it that information.