SvelteKit Auth - signinUrl using wrong protocol and Cross-site POST form submissions error

Start with the SvelteKit integration in src/hooks.server.ts and the client entry points in src/routes/+layout.svelte and +layout.server.ts, then reproduce the sign-in flow from the linked reproduction and documentation. Trace the generated signinUrl and callbackUrl and the cross-site POST failure; done means the Google sign-in action redirects successfully without the protocol or form-security error.

Environment

I'm using sveltekit, so I'll give the versions relevant to it.

"devDependencies": {
	"@sveltejs/adapter-auto": "^1.0.0",
	"@sveltejs/kit": "^1.0.0",
	"svelte": "^3.54.0",
	"vite": "^4.0.0"
},
"dependencies": {
	"@auth/core": "^0.2.5",
	"@auth/sveltekit": "^0.1.12"
}

I'm using node.js 18.2.0 on replit using Ubuntu 20.04.2 LTS (Focal Fossa). My browser is chrome 108.0.5359.124.

Reproduction URL

https://replit.com/@grapecoder/amc

Describe the issue

When setting up Auth.js for SvelteKit, I followed the instructions in the documentation here. However, when trying to have my sign in button do the function signIn(), nothing was happening when I clicked on it. In the console, I got a 403 error saying that Cross-site POST form submissions are forbidden. So, after that I tried copying the method in the example repo which uses a link to /auth/signin/ instead. However, that still didn't work as when I click on the Sign in with Google button I get the same error and an alert saying that this form isn't secure. I believe the issue is due to the callbackUrl and signinUrl using the http protocol instead of https. This is my first time using this library in a while and back then there was an environment variable named NEXTAUTH_URL that would fix this issue but apparently it doesn't exist anymore. I'm using the google provider so I tried going through the code for the provider and the OAuthConfig interfaces to see whether I could modify this but I couldn't find anything.

Here is some of my code:

// /src/hooks.server.ts
import { SvelteKitAuth } from "@auth/sveltekit"
import Google from "@auth/core/providers/google"
import { GOOGLE_ID, GOOGLE_SECRET } from "$env/static/private"

export const handle = SvelteKitAuth({
	//@ts-expect-error issue https://github.com/nextauthjs/next-auth/issues/6174
	providers: [Google({
		clientId: GOOGLE_ID,
		clientSecret: GOOGLE_SECRET,
	})]
});

// /src/routes/+layout.server.ts
import type { LayoutServerLoad } from './$types';

export const load: LayoutServerLoad = async (event) => {
  return {
    session: await event.locals.getSession()
  };
}; 

<!-- /src/routes/+layout.svelte -->
<script>
	import '../app.postcss';
	
  import { DarkMode } from 'flowbite-svelte';
	import { Navbar, NavBrand, NavLi, NavUl, NavHamburger, Button, Input, P } from 'flowbite-svelte';
	import { page } from "$app/stores";
	import { signIn, signOut } from "@auth/sveltekit/client"
</script>

<div>
	<Navbar let:hidden let:toggle>
  <NavBrand href="/">
    <img
      src="https://flowbite.com/docs/images/logo.svg"
      class="mr-3 h-6 sm:h-9"
      alt="Flowbite Logo"
    />
    <span class="self-center whitespace-nowrap text-xl font-semibold dark:text-white">
      AMC Trainer
    </span>
  </NavBrand>
  <div class="flex md:order-2">
		<DarkMode class="mr-3" />
		{#if $page.data.session}
			<P>Signed in as {$page.data.session.user?.name}</P>
		{:else}
			<Button size="sm" href="/auth/signin" data-sveltekit-preload-data="off">Sign in</Button>	
		{/if}
    <NavHamburger on:click={toggle} />
  </div>
  <NavUl {hidden} class="order-1">
    <NavLi href="/" active={$page.url.pathname == "/"}>Home</NavLi>
    <NavLi href="/about">About</NavLi>
    <NavLi href="/services">Services</NavLi>
    <NavLi href="/pricing">Pricing</NavLi>
    <NavLi href="/contact">Contact</NavLi>
  </NavUl>
</Navbar>
<!--text-slate-900 dark:text-slate-100  -->
<div class="my-5 lg:mx-40 md:mx-20 mx-10 ">
	<slot />
</div>

</div>

How to reproduce

Follow the exact same instructions at https://authjs.dev/reference/sveltekit/modules/main but use the google provider instead.

Expected behavior

It should redirect to the google sign in page.