Don't reject connection.secure, and add an implementation of cr-demo for (manual) testing.
Merge bug 25688
stable to default