CfC: only allow authenticated origins to call getUserMedia

Following the recent discussion on the list, the Chairs detect that 
there seems to be consensus to move to only allowing authenticated 
origins (as defined in [1]) to use getUserMedia (both the callback and 
Promise version).

Please respond by Friday this week (Oct 10th) if you’re OK or Not OK 
with this change (silence will be interpreted as being OK with it).

Harald and Stefan

[1] 
https://w3c.github.io/webappsec/specs/mixedcontent/#is-origin-authenticated