Steve,
Suggestions would be:
1. Have a look at the Chrome debugger and see if you can the HTTP request leave and return. I'm not next to my 'real' computer so can't check that bit myself. You *should* be able to see the packets and see if a connection has been made. I know Firefox does this very well.
2 Can you look at the output of the log file from the REST server? Is there anything coming in thats being rejected.
3. Is there another server you can see to check access to. I have often thought I'd set up a simple reflective REST server that simply works and sends back whatever was passed in but slightly modified so you can see its worked.
I *think* that Android handles whitelists differently to Android. Kerri will be able to answer that question better than me though. I know my limitations there :)
It has the smell of a permissioning problem. The other option if you have any hair left is to pull that plugin and use the old legacy whitelist plugin to see if that works. Its not a massive change to make to test this out.
I can probably give you another server to test against if that helps but would not be until tomorrow that I can configure it.
Rob.