Both false positives and false negatives of HttpRequest.is_secure can be dangerous. Backport of 840ffd80 from master