Require clients to use CONNECT for HTTPS; remind about no-transform/warn
move wpd proxies to a separate section
*un*identified payload
be a bit more specific
update XML