Sites shouldn't make use of the unsafe-url coverage, as this may trigger HTTPS URLs to become exposed on the wire over an HTTP relationship, which defeats on the list of critical privacy and stability ensures of HTTPS. HTTPS is currently the preferred protocol for all activity on the Web, as http://XXX