Don't install insecurely without el-get-allow-insecure.

In most cases, we assume any connection is insecure unless the URL
starts with "https://", "$USERNAME@", or "ssh". There are a few
exceptions: I'm assuming all Emacswiki packages are insecure, and I
don't think we can know whether packages installed via Google Go are
secure or not.
Set el-get-allow-insecure to avoid breakage.

This should be changed to nil in a future major release bump.
Document el-get-allow-insecure in manual.
Merge pull request #1856 from technomancy/allow-insecure

Don't install insecurely without el-get-allow-insecure.