Currently, we have a few holes in our 'upgrade-insecure-requests' implementation (mostly around redirects). Once we resolve those, we should be able to get away with a simple tri-state policy state, rather than the multiple flags we're currently storing on SecurityContext (and replicating from frame to frame).