For security reasons, JavaScript contained in one web page can access data in another web page only if both web pages have the same origin (i.e., basically coming from the same host). This policy is called the Same Origin Policy. This means that JS9 cannot load a FITS file from an arbitrary URL without using special techniques.
One such technique is to use a proxy server: the URL is not loaded directly into JS9, but instead is copied back to the server from which JS9 itself was loaded. The file is then retrieved by JS9 so that the "same origin" rules are not violated.
When the back-end server associated with a JS9 web page supports the proxy service, you will see a menu option in the File menu called open link via proxy ...
Enter a FITS URL into the proxy dialog box and press the Load button. The data file will be retrieved by the server and stored in a directory specifically tied to the web page. (The directory and its contents will be deleted when the page is unloaded.) JS9 then will load the file from this directory. Note that since the file resides on the back-end server, all back-end analysis defined on that server is available.
You also can drag and drop the link directly onto the JS9 display. The open link via proxy ... menu option is mentioned first, because it can sometimes require less dexterity (e.g., the archive web page is displayed on a different desktop from JS9) and also because it contains a visual cue regarding proxy loads: the option will be greyed out if JS9 has not been configured to allow proxy loads.
This proxy load technique can also be used FITS links from other sources. For example, if you have a FITS file on Google Drive, iCloud, Dropbox or even a static web page, you can generate/copy the link and paste it into the proxy dialog box for display. (Dropbox files also can utilize the open link via CORS ... option, which downloads the data directly to JS9, bypassing the proxy server.)