Thanks Eric, I'd forgotten that I had added Edge to the AppContainer Loopback Exemption Utility.
My hosts file has two entries:
So the SPA is served from web.app.test which is making ajax calls to api.app.test (this is so I can share an authentication cookie across subdomains).
If I add web.app.test to the Local Intranet zone then Edge is happy, without the need to use Fiddler to get around the issue. It's all a bit horrible but as it shouldn't be a problem in production I've resolved not to worry about it.
Thanks again for all your help with this and for the brilliant and irreplaceable Fiddler.