Web sites mustn't utilize the unsafe-url policy, as this will likely induce HTTPS URLs to become exposed on the wire around an HTTP relationship, which defeats one of several crucial privacy and safety ensures of HTTPS. SSL/TLS is particularly fitted to HTTP, as it can provide some protection even though http://XXX