Change from Scheme to IsSecure as authoritative.

Reviving this PR for beta2. This primarily affects servers, not applications or middleware.

#102 
throw new InvalidOperationException()?