Tell browsers that not using SSL is okay so that eventually we can remove it

- See https://github.com/rails/rails/issues/5123