This should be in an aptly named and commented file on it's own, e.g. `h5bp/cross-domain-insecure.conf`