The URL itself doesn’t get sent over the wire. Charles only knows the host name, port, and path. I assume it’s reconstructing the scheme name by looking at the port number (and maybe clues in the headers.)
Did you specify an explicit port number in the URL? If you used a port number that’s normally use for SSL (like 443) then Charles may assume you used a wss: scheme.
It’s an actual problem. If I specify 4984 port in the URL like ws://xxx.com:4984, it works well. However, I use nginx to proxy sync gateway, and then the URL is ws://xxx.com/syncgateway, it always get 400 response. I find it want to connect 443 port of the remote server as Charles shows.