CLEAR: Actually block on insecure requests.

Author: mikewest

specs/clear-site-data/index.src.html

@@ -420,10 +420,18 @@ <h3 id="clear">
   <a><code>Clear-Site-Data</code></a> header to determine what needs to be
   cleared, which origins are affected, and then executes those requests.
 
-  1.  Let <var>exclusions</var> be the result of [[#get-exclusions]] executed on
+  1.  If <var>response</var>'s {{URL}} is <a><i lang="la">a priori</i>
+      insecure</a>, skip the remaining steps of this algorithm.
+
+      ISSUE: Some have suggested that this might not be a restriction we want
+      (see
+      <a href="https://lists.w3.org/Archives/Public/public-webappsec/2015Jun/0032.html">Martin
+      Thomson's public-webappsec post on the topic</a>, for example).
+
+  2.  Let <var>exclusions</var> be the result of [[#get-exclusions]] executed on
       <var>response</var>.
 
-  2.  Let <var>subdomain state</var> be the result of
+  3.  Let <var>subdomain state</var> be the result of
       [[#should-include-subdomains]] executed on <var>response</var>.
 
   4.  If <var>exclusions</var> does not contain "<code>contexts</code>", execute