Deprecate accessing non secure origins by default

* Deprecates accessing non secure origins by default, the list of which is taken from Chrome.
* Adds a --trusted-host flag to enable users to mark a specific host as a secure origin regardless of what we think.
* Refactors the original warning to better indicate the intent and the new flag.

Closes #2158
Fixes #1313
This doesn't explicitly mention that the `--trusted-host` flag is new or how to use it...?