Re: [fetch] Exempt HSTS-upgraded resources from mixed content blocking (#150)

@mikewest ah, you already started working on this, great! I thought the plan was that I would put it in Fetch, but I'm happy for you to drive this too.

My plan was to branch on credentials based on the request since it would allow for reuse of the connection and does not seem dangerous for `/`. The other bits seem reasonable.

(At some point we should also start doing this for navigational requests, so sites that use HSTS don't have to use HSTS preload to be secure even on first use. But that would be a later addition.)

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/150#issuecomment-154023693