Deprecate accessing non secure origins by default

* Deprecates accessing non secure origins by default, the list of
  which is taken from Chrome.
* Adds a --trusted-host flag to enable users to mark a specific
  host as a secure origin regardless of what we think.
* Refactors the original warning to better indicate the intent
  and the new flag.
Merge pull request #2162 from dstufft/trusted-hosts

Deprecate accessing non secure origins by default