[staticfish]

not if it's pinned at the web app level.

[tyre]

Again, MITM.

If you mean the front-end web (JS) app, MITM the request from the server to the client browser and replace the hardcoded submission url in the JS.

[staticfish]

Not really. I used Play Framework which is also its own webserver. SSL is at both the app and webserver level.