[MIX]: Future-proof the spec.
[MIX]: User agents SHOULD block all mixed content.
[MIX]: User agents MAY screw with requests for mixed content.
[MIX]: Typos.
MIX: Block private resources from public resources.
[MIX]: Renaming origin types for clarity.
CSP: Add a non-normative description of what policy applies to what resource in what context.
CSP: Organizing the table. h/t annevk.
CSP: Drop RFC2616 in favor of RFC7230 and RFC7231.
MIX: Clarifying 'weakly TLS-protected'.
CSP: Allow <meta> to tighten existing policy.
CSP: Block redirects by default, introduce 'unsafe-redirect'.
Merge pull request #32 from w3c/redirect

CSP: Block redirects by default, introduce 'unsafe-redirect'.
CSP: New HTML.
CSP: Clarifying subresource policy for SVG images/fonts. Those are safe right? ... Right?
CSP: Defining the CH-CSP Client Hint.
CSP: Limit the client hint to redirect-enabled policies.
CSP: Switch from 'empty 400 response' to 'fatal network error'.
CSP: Cleaning up two typos.
Merge branch 'master' into referrer