Deprecate accessing non secure origins by default

* Deprecates accessing non secure origins by default, the list of which is taken from Chrome.
* Adds a --trusted-host flag to enable users to mark a specific host as a secure origin regardless of what we think.
* Refactors the original warning to better indicate the intent and the new flag.

Closes #2158
Fixes #1313