expand allow_unsafe
only http and https as default protocols
add add_csp_allow_unsafe note
to 0.4 as add_domain no longer includes ws:// and wss:// by default
0.4.1