The initial work done for issue 588931 prevented new appcache  associations for insecure origins (http vs. https). 

Issue 899752 points out that this doesn't prevent existing associations from intercepting requests. That could be fixed by not even checking for insecure origins.

Once addressed, however, there will still be existing caches for insecure origins. Purging those would free space for users.