Be draconian.
Replace 'insecure origin' with 'unsecured environment'/'insecure url'.
Recommend no zeroclick for private browsing.